JP1 Version 13 JP1/IT Desktop Management 2 Overview and System Design Guide

3021-3-L72-30(E)

Notices

Relevant program products

For details about the supported operating systems and the service packs or patches that are required by JP1/IT Desktop Management 2, see the Release Notes.

P-2A42-78DL JP1/IT Desktop Management 2 - Manager 13-11

The above product includes the following:

• P-CC2A42-7ADL JP1/IT Desktop Management 2 - Manager (for Windows Server 2022, Windows Server 2019, Windows Server 2016)

• P-CC2A42-7BDL JP1/IT Desktop Management 2 - Agent (forWindows Server 2022, Windows 11, Windows Server 2019, Windows Server 2016, Windows 10, Windows 8.1, Windows 8, Windows Server 2012, Windows 7, Windows Server 2008 R2)

• P-CC2A42-7CDL JP1/IT Desktop Management 2 - Network Monitor (for Windows Server 2022, Windows 11, Windows Server 2019, Windows Server 2016, Windows 10, Windows 8.1 Enterprise, Windows 8.1 Pro, Windows 8 Enterprise, Windows 8 Pro, Windows Server 2012, Windows 7 Enterprise, Windows 7 Professional, Windows 7 Ultimate)

• P-CC2A42-7DDL JP1/IT Desktop Management 2 - Asset Console (for Windows Server 2022, Windows Server 2019, Windows Server 2016)

• P-CC2A42-7PDL JP1/IT Desktop Management 2 - Internet Gateway (for Windows Server 2022, Windows Server 2019, Windows Server 2016)

P-2A42-7KDL JP1/IT Desktop Management 2 - Operations Director 13-11

The above product includes the following:

• P-CC2A42-7ADL JP1/IT Desktop Management 2 - Manager (for Windows Server 2022, Windows Server 2019, Windows Server 2016)

• P-CC2A42-7BDL JP1/IT Desktop Management 2 - Agent (for Windows Server 2022, Windows 11, Windows Server 2019, Windows Server 2016, Windows 10, Windows 8.1, Windows 8, Windows Server 2012, Windows 7, Windows Server 2008 R2)

• P-CC2A42-7CDL JP1/IT Desktop Management 2 - Network Monitor (for Windows Server 2022, Windows 11, Windows Server 2019, Windows Server 2016, Windows 10, Windows 8.1 Enterprise, Windows 8.1 Pro, Windows 8 Enterprise, Windows 8 Pro, Windows Server 2012, Windows 7 Enterprise, Windows 7 Professional, Windows 7 Ultimate)

• P-CC2A42-7PDL JP1/IT Desktop Management 2 - Internet Gateway (for Windows Server 2022, Windows Server 2019, Windows Server 2016)

Trademarks

BSAFE is a trademark or registered trademark of Dell Inc. in the United States and other countries.

NetShield and VirusScan are registered trademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries.

OfficeScan and PC-Cillin are trademark of Trend Micro Incorporated.

Oracle, Java, and MySQL are registered trademarks of Oracle and/or its affiliates.

Other company and product names mentioned in this document may be the trademarks of their respective owners.

This product includes software developed by the Apache Software Foundation (http://www.apache.org/).

This product includes software developed by Ben Laurie for use in the Apache-SSL HTTP server project.

Portions of this software were developed at the National Center for Supercomputing Applications (NCSA) at the University of Illinois at Urbana-Champaign.

This product includes software developed by the University of California, Berkeley and its contributors.

This software contains code derived from the RSA Data Security Inc. MD5 Message-Digest Algorithm, including various modifications by Spyglass Inc., Carnegie Mellon University, and Bell Communications Research, Inc (Bellcore).

Regular expression support is provided by the PCRE library package, which is open source software, written by Philip Hazel, and copyright by the University of Cambridge, England. The original software is available from ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/

This product includes software developed by Ralf S. Engelschall <rse@engelschall.com> for use in the mod_ssl project (http://www.modssl.org/).

This product includes software developed by IAIK of Graz University of Technology.

This product includes software developed by Daisuke Okajima and Kohsuke Kawaguchi (http://relaxngcc.sf.net/).

This product includes software developed by the Java Apache Project for use in the Apache JServ servlet engine project (http://java.apache.org/).

This product includes software developed by Andy Clark.

This product bundles Dell BSAFETM software developed by Dell Inc. in the United States.

Java is a registered trademark of Oracle and/or its affiliates.

Java is a registered trademark of Oracle and/or its affiliates.

1. This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit. (http://www.openssl.org/)

2. This product includes cryptographic software written by Eric Young (eay@cryptsoft.com)

3. This product includes software written by Tim Hudson (tjh@cryptsoft.com)

4. This product includes the OpenSSL Toolkit software used under OpenSSL License and Original SSLeay License. OpenSSL License and Original SSLeay License are as follow:

LICENSE ISSUES

==============

The OpenSSL toolkit stays under a dual license, i.e. both the conditions of

the OpenSSL License and the original SSLeay license apply to the toolkit.

See below for the actual license texts. Actually both licenses are BSD-style

Open Source licenses. In case of any license issues related to OpenSSL

please contact openssl-core@openssl.org.

OpenSSL License

---------------

/* ====================================================================

* Copyright (c) 1998-2016 The OpenSSL Project. All rights reserved.

*

* Redistribution and use in source and binary forms, with or without

* modification, are permitted provided that the following conditions

* are met:

*

* 1. Redistributions of source code must retain the above copyright

* notice, this list of conditions and the following disclaimer.

*

* 2. Redistributions in binary form must reproduce the above copyright

* notice, this list of conditions and the following disclaimer in

* the documentation and/or other materials provided with the

* distribution.

*

* 3. All advertising materials mentioning features or use of this

* software must display the following acknowledgment:

* "This product includes software developed by the OpenSSL Project

* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"

*

* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to

* endorse or promote products derived from this software without

* prior written permission. For written permission, please contact

* openssl-core@openssl.org.

*

* 5. Products derived from this software may not be called "OpenSSL"

* nor may "OpenSSL" appear in their names without prior written

* permission of the OpenSSL Project.

*

* 6. Redistributions of any form whatsoever must retain the following

* acknowledgment:

* "This product includes software developed by the OpenSSL Project

* for use in the OpenSSL Toolkit (http://www.openssl.org/)"

*

* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR

* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

* OF THE POSSIBILITY OF SUCH DAMAGE.

* ====================================================================

*

* This product includes cryptographic software written by Eric Young

* (eay@cryptsoft.com). This product includes software written by Tim

* Hudson (tjh@cryptsoft.com).

*

*/

Original SSLeay License

-----------------------

/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)

* All rights reserved.

*

* This package is an SSL implementation written

* by Eric Young (eay@cryptsoft.com).

* The implementation was written so as to conform with Netscapes SSL.

*

* This library is free for commercial and non-commercial use as long as

* the following conditions are aheared to. The following conditions

* apply to all code found in this distribution, be it the RC4, RSA,

* lhash, DES, etc., code; not just the SSL code. The SSL documentation

* included with this distribution is covered by the same copyright terms

* except that the holder is Tim Hudson (tjh@cryptsoft.com).

*

* Copyright remains Eric Young's, and as such any Copyright notices in

* the code are not to be removed.

* If this package is used in a product, Eric Young should be given attribution

* as the author of the parts of the library used.

* This can be in the form of a textual message at program startup or

* in documentation (online or textual) provided with the package.

*

* Redistribution and use in source and binary forms, with or without

* modification, are permitted provided that the following conditions

* are met:

* 1. Redistributions of source code must retain the copyright

* notice, this list of conditions and the following disclaimer.

* 2. Redistributions in binary form must reproduce the above copyright

* notice, this list of conditions and the following disclaimer in the

* documentation and/or other materials provided with the distribution.

* 3. All advertising materials mentioning features or use of this software

* must display the following acknowledgement:

* "This product includes cryptographic software written by

* Eric Young (eay@cryptsoft.com)"

* The word 'cryptographic' can be left out if the rouines from the library

* being used are not cryptographic related :-).

* 4. If you include any Windows specific code (or a derivative thereof) from

* the apps directory (application code) you must include an acknowledgement:

* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"

*

* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND

* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE

* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL

* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS

* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF

* SUCH DAMAGE.

*

* The licence and distribution terms for any publically available version or

* derivative of this code cannot be changed. i.e. this code cannot simply be

* copied and put under another distribution licence

* [including the GNU Public Licence.]

*/

Microsoft product screen shots

Microsoft product screen shots reprinted with permission from Microsoft Corporation.

Restrictions

Information in this document is subject to change without notice and does not represent a commitment on the part of Hitachi. The software described in this manual is furnished according to a license agreement with Hitachi. The license agreement contains all of the terms and conditions governing your use of the software and documentation, including all warranty rights, limitations of liability, and disclaimers of warranty.

Material contained in this document may describe Hitachi products not available or features not available in your country.

No part of this material may be reproduced in any form or by any means without permission in writing from the publisher.

Issued

Mar. 2025: 3021-3-L72-30(E)

Copyright

Copyright (C) 2023, 2025, Hitachi, Ltd.

Copyright (C) 2023, 2025, Hitachi Solutions, Ltd.

Colophon

Publisher

Hitachi, Ltd.

6-6, Marunouchi 1-chome, Chiyoda-ku, Tokyo, 100‒8280 Japan

Summary of amendments

The following table lists changes in this manual (3021-3-L72-30(E)) and product changes related to this manual.

Changes

Location

When using Google Workspace as an integrated MDM system, Chromebook devices can now be managed.

2.6.1(1), 2.6.2(3), 2.6.2(4), 2.6.2(7), 2.6.6, 2.6.6(2), 2.6.6(4), 2.9.2, 2.11, 2.23, 3.1, 4.3.6, 4.4.8, Appendix A.4(21), Appendix A.15(3), Appendix A.15(4), Appendix B

When managing Windows PCs using Microsoft Intune as an integrated MDM system, malware-infected devices can now be automatically block from the network.

2.6.2(3), 2.6.6, 2.6.6(2), 2.6.6(4), 2.9.7, 3.1, Appendix A.4(21), Appendix A.5, Appendix B

The HIBUN log added in HIBUN version 13 can be imported.

2.10.8(4), 2.10.8(6)

When exporting operation logs, the IP address of the Agent can also be output.

Appendix A.5

In addition to the above changes, minor editorial corrections were made.

Preface

This manual provides an overview of JP1/IT Desktop Management 2 - Manager and JP1/IT Desktop Management 2 - Operations Director, and describes their functionality and system design methodology. Hereinafter, the term JP1/IT Desktop Management 2 is used to refer to both JP1/IT Desktop Management 2 - Manager and JP1/IT Desktop Management 2 - Operations Director.

Compared with JP1/IT Desktop Management 2 - Manager, some functions of JP1/IT Desktop Management 2 - Operations Director are restricted. For details about functional restrictions, see A.13 Functional restrictions in JP1/IT Desktop Management 2 - Operations Director.

For details about the latest notes, see the Release Notes.

Intended readers

This manual is intended for:

Those who are considering installing JP1/IT Desktop Management 2 or who want to design JP1/IT Desktop Management 2 systems.

Those who want to gain an overview of JP1/IT Desktop Management 2 products and function details

Organization of this manual

This manual is organized into the following chapters and appendixes:

1. Product Overview

This chapter provides an overview of JP1/IT Desktop Management 2, and describes its system components.

2. Features of JP1/IT Desktop Management 2

This chapter explains JP1/IT Desktop Management 2 functions.

3. About Product Licenses

This chapter describes the product licenses of JP1/IT Desktop Management 2.

4. System Design

This chapter provides an overview of how to design a system and start operation. This chapter also describes the issues that must be considered during system design.

Appendix A. Miscellaneous Information

This appendix provides reference information on using JP1/IT Desktop Management 2.

Appendix B. Glossary

This appendix explains terms used in JP1/IT Desktop Management 2.

1 Product Overview

JP1/IT Desktop Management 2 enables organizations to enforce security policies and manage IT assets. This chapter provides an overview of JP1/IT Desktop Management 2 and its system components.

1.1 Product overview

With information technology used so widely today, there is greater need for IT equipment that will help organizations to operate efficiently and reduce administrative costs. However, as information technology progresses, it is increasingly difficult to manage complex systems, to understand the operating status, detailed security settings and security procedures of all the devices. In this situation, the question of how to manage IT devices efficiently and accurately becomes all the more pressing.

JP1/IT Desktop Management 2 provides intuitive operations aligned to the task at hand, and automation functions based on simple settings and scheduling to support the security and asset management aspects of IT device management. Deploying JP1/IT Desktop Management 2 lessens the administrator's workload in managing a complex system and facilitates smooth running of the organization.

1.1.1 Product benefits

JP1/IT Desktop Management 2 provides a means of managing an organization's security infrastructure and assets. To manage device security in an organization, rules must be laid down and users required to comply. Administrators must keep track of security issues and respond appropriately.

JP1/IT Desktop Management 2 supports security and asset management as follows:

Full picture of IT device status

Enforcement of security rules for IT devices

Identification and resolution of security vulnerabilities

IT network monitoring

Software installation and maintenance

Remote control of user computers

Full picture of IT device status

To properly manage the security of IT devices, the administrator must first understand which devices are subject to security rules. To manage the devices as assets within the organization, the administrator must know what hardware and software is being used and how everything is currently configured. JP1/IT Desktop Management 2 has functionality to periodically search and discover devices in the network and collect information about them automatically. Information is acquired about any new device discovered in the search, allowing IT equipment to be managed using accurate, up-to-date information. This reduces the administrator's workload in data collection.

Enforcement of security rules for IT devices

One of the options for determining organizational security rules is an Information Security Management System (ISMS). To manage security under an ISMS, users must comply with rules relating to settings and operations. In JP1/IT Desktop Management 2, the rules determined by the organization are applied to IT devices as security policies, and degrees of compliance with those policies can be monitored. This allows rules to be enforced on the devices. If any computer violates a security policy, action can be taken or the offender sent a warning message automatically, relieving the administrator and senior staff from having to deal with users directly.

Identification and resolution of security vulnerabilities

To run an organization's computers securely, vulnerable computers must be identified and response measures quickly put in place to forestall virus infections and information leaks. Getting to the root of a problem by manually checking an array of measures, such as the computer's security settings, application of anti-virus products or Windows updates, and protection against information leaks can be extremely time-consuming and costly. With JP1/IT Desktop Management 2, you can check through a listing of the security status of each computer, and immediately spot any security issues. If there is a problem, the security of the whole system can be managed efficiently by automatically applying anti-virus products and Windows updates and isolating insecure devices from the network.

IT network monitoring

The widespread use of mobile computing poses the risk that people may bring their own computers into the organization. Connection of unauthorized equipment into the network can result in information leaks and virus infections. To prevent such damage, the organization's network is monitored so that newly connected devices are immediately discovered. JP1/IT Desktop Management 2 can check for unauthorized connections and automatically isolate any device that has no security provision. By using this network monitoring functionality, you can see all the network connections within the organization and better safeguard the system security.

Software installation and maintenance

For computer-based business tasks, the required software needs to be installed on the computers. This takes time if users have to do their own installations. Using JP1/IT Desktop Management 2, in a single operation you can install software on all the computers where it is required. Upgrades can be performed promptly, however frequently they are needed. Updated programs designed to fix a bug or correct a security issue can be distributed and applied automatically.

Remote control of user computers

With the rapid advance in information technology in recent years, users who are not equipped to set up applications or troubleshoot problems are increasingly common. To handle their computer problems, organizations typically rely on a system administrator with specialist knowledge. If workplaces are dispersed, it becomes difficult to respond in a timely manner. Using JP1/IT Desktop Management 2, when a problem occurs on a computer in another location, the system administrator can take immediate action from his or her own computer, enabling fast response by remote control.

1.1.2 Functionality to support security management using a PDCA cycle

ISMS recommends the PDCA cycle approach to run and improve a security management system. The functionality provided by JP1/IT Desktop Management 2 supports controls determined by the organization in each of the processes of a PDCA cycle for security management.

The following figure shows JP1/IT Desktop Management 2 functions and support for security management through the PDCA cycle.

JP1/IT Desktop Management 2 operation (actions performed by the administrator) through the PDCA cycle for security management is as follows:

1. Plan: Establish

Diagnose the security status of the computers in the organization using JP1/IT Desktop Management 2

From the diagnostic results, evaluate the system security status and work out potential issues. From this evaluation, devise the organization's security rules and consider how to implement them.

2. Do: Implement and operate

Set security policies and apply them to the computers using JP1/IT Desktop Management 2.

If any computers with vulnerabilities are discovered, take measures using JP1/IT Desktop Management 2.

3. Check: Monitor and review

Using JP1/IT Desktop Management 2, judge whether any device poses a security risk.

Diagnose the system security from the results of this judgment process, using JP1/IT Desktop Management 2.

From the diagnostic results, determine trends and identify unresolved issues.

4. Action: Maintain and improve

Implement measures for identified issues.

Using JP1/IT Desktop Management 2, output a security diagnostics report and review results.

Based on the review, plan how to improve the security rules in the next cycle.

1.1.3 Flow of asset management

JP1/IT Desktop Management 2 can collectively manage the IT resources in an organization (hardware assets and software licenses). Asset contracts can also be included.

From purchase to disposal of hardware assets

The following figure shows the flow from purchase to disposal of a hardware asset.

On purchasing a hardware asset, the administrator must build the hardware asset environment and register hardware asset information in JP1/IT Desktop Management 2. (steps 1 and 2)

The hardware asset is then delivered to the user or stored as stock if not immediately deployed. As the need arises for replacement or temporary use of hardware assets, stock may be distributed to users and items collected from users after use. The hardware asset information in JP1/IT Desktop Management 2 is updated accordingly. (steps 3 to 5)

When a hardware asset is no longer needed, it is disposed of and the hardware asset information in JP1/IT Desktop Management 2 is updated accordingly. (step 6)

From purchase to disposal of software assets

The following figure shows the flow from purchase to disposal of a software asset.

When a user applies to use software, the request is checked and the software license is purchased. The administrator decides the software name (managed software name) under which usage of the purchased software will be managed, and registers the managed software information and license information in JP1/IT Desktop Management 2. (steps 1 to 3)

Before delivering the purchased software to the user, the administrator or department in which the software will be used performs the acceptance processing. If the software undergoing the acceptance process is installed on a computer managed by JP1/IT Desktop Management 2, software information will be acquired by the management server. The administrator then maps the collected software information with the managed software information. The administrator will then be able to view the installation status of the managed software from an operation window. Next, the administrator checks the user's application for software usage and grants approval. Once the software is installed, software information is acquired by the management server, allowing the administrator to keep track of software license usage from an operation window. (steps 4 to 6)

When the software is no longer needed, it is removed and eliminated. The software license information in JP1/IT Desktop Management 2 is updated accordingly. (steps 7 and 8)

1.2 System components

In this manual, when referring to a system managed by JP1/IT Desktop Management 2, defined names are used for the system components such as network devices and the servers and computers on which JP1/IT Desktop Management 2 is installed.

Definitions used in JP1/IT Desktop Management 2 for basic system components are given in the following table.

Component name

Definition

Management server

The server on which JP1/IT Desktop Management 2 is installed as a relay system. A database for storing the various information managed by JP1/IT Desktop Management 2 is created on the management server.

When distribution using Remote Install Manager is described, this server might also be referred to as managing server or manager.

Administrator's computer

The computer on which the administrator performs management tasks using the JP1/IT Desktop Management 2 operation windows. JP1/IT Desktop Management 2 displays windows in a browser. This allows the administrator to work from any computer that can access the management server. The management server itself can be used as the administrator's computer.

The administrator can download a program (controller) for remotely controlling computers from the operation windows and remotely control user computers.

If you want to utilize distribution using Remote Install Manager, Remote Install Manager must be installed,

Device

Computer

A computer on which an OS is installed. The types of computers are as follows:

A computer on which an agent is installed

A computer on which an agent for online management is installed (online managed computer)

A computer on which an agent for offline management is installed (offline managed computer)

A computer without any agent installed (agentless managed computer)

IP device

A device other than a computer with an IP address. Examples include a router, network printer, or IP phone.

Peripheral

A device without an IP address, such as a mouse, keyboard, or USB device.

The following figure shows an example of a basic system configuration consisting of these components and managed by JP1/IT Desktop Management 2.

By adding another JP1/IT Desktop Management 2 component or linking JP1/IT Desktop Management 2 to another system, you can manage the system for a specific purpose, such as load balancing, enhanced security, or management of additional information.

Definitions of system components added for a specific purpose are given in the following table.

Component name

Definition

Relay system#

A server on which JP1/IT Desktop Management 2 - Agent is installed as a relay system.

A relay system is installed when you utilize distribution using Remote Install Manager. Installing a relay system can reduce loads on the Management server and network.

A system that has a relay system is called a basic configuration system of JP1/IT Desktop Management 2.

Management relay server#

A server on which JP1/IT Desktop Management 2 - Manager is installed as a management relay server. An agent is automatically installed when JP1/IT Desktop Management 2 - Manager is installed. This agent is called an agent for management relay server.

If you install a management relay server, you can perform load distribution among administrators or management servers, or support a NAT environment. If you want to operate JP1/IT Desktop Management 2 separately for each department or network configuration, a management relay server must be installed.

If you install a management relay server, a hierarchical system must be built with a primary management server and multiple management relay servers. The hierarchical system is called a multi-server-configuration system for JP1/IT Desktop Management 2. In a multi-server-configuration system, a primary management server and management relay servers can be collectively called management servers.

As opposed to a multi-server configuration, a system in which JP1/IT Desktop Management 2 is operated by a single management server is called a single-server configuration.

Primary management server#

A server that is installed at the top of the hierarchical system of management relay servers (i.e. multi-server-configuration system) among the servers on which JP1/IT Desktop Management 2 - Manager is installed. In a multi-server-configuration system, a primary management server and management relay servers can be collectively called management servers.

Support service site

A website that provides Hitachi support services. By connecting to this site via the Internet from JP1/IT Desktop Management 2, you can obtain information about the latest update programs and anti-virus products. This information is used by the system to determine whether the update programs and anti-virus products installed on each computer are up to date.

A system linked with a support service site is known as a support service linkage configuration system.

Asset management server#

A server on which JP1/IT Desktop Management 2 - Asset Console (Asset Console) is installed. This server is installed when you want to perform detailed asset information management, including customizing an asset information search window, or performing an asset information management job using items.

Active Directory server

A server on which Active Directory is installed. The Active Directory program is required so that JP1/IT Desktop Management 2 can acquire information managed by Active Directory.

A system linked with Active Directory is known as an Active Directory linkage configuration system.

MDM server

A server for managing smart devices using an installed MDM product. An MDM product is required so that JP1/IT Desktop Management 2JP1/IT Desktop Management 2 can acquire information about smart devices managed by the MDM product.

A system linked with an MDM product is known as an MDM linkage configuration system.

Network monitoring agent

A JP1/IT Desktop Management 2 component for monitoring and controlling device network connections.

The network monitoring agent is installed when a network monitor is enabled on an online managed computer.

Once the agent is installed, JP1/IT Desktop Management 2 can monitor the network, detect connection by new devices and deny access.

A network monitor-enabled system is known as a network monitoring configuration system.

Network control appliance#

An appliance product on which JP1/NETM/NM is installed. By linking with JP1/NETM/NM - Manager, JP1/IT Desktop Management 2 can control the network connections monitored by a JP1/NETM/NM-installed appliance product. A system linked with JP1/NETM/NM - Manager is known as a JP1/NETM/NM - Manager linkage configuration system.

JP1/IM server#

A server on which JP1/IM is installed for integrated monitoring of JP1 products and other programs. In addition to JP1/IT Desktop Management 2, the JP1/IM server requires JP1/IM and JP1/Base. Errors occurring on any of the managed computers can be centrally managed in JP1/IM as JP1 events.

A system linked with JP1/IM is known as a JP1/IM monitoring configuration system.

#: Not supported in JP1/IT Desktop Management 2 - Operations Director.

The following figure shows an example of a purpose-built system configuration managed by JP1/IT Desktop Management 2.

For details about the system configuration, see 4.4 Examining the system configuration.

1.3 Program modules

In JP1/IT Desktop Management 2 you can access functions by clicking the buttons at the top and opening a different module. Choose the appropriate module for the operation you want to perform.

The operation window can be logged in from multiple computers simultaneously. Even if the operation window is manipulated from multiple computers simultaneously, the changes will not be reflected to the operation window in real time.

The operations you can perform in each module are described next.

Home module

In the Home module, you have an overview of the information managed by JP1/IT Desktop Management 2, presented in the panels. From each panel you can navigate to another module to perform a management operation.

Security module

In the Security module, you can allocate security policies to computers, manage their security status and take action if any computer poses a security risk. You can also investigate suspicious operations from the operation logs.

Assets module

In the Assets module, you can manage the status and stocktaking dates of hardware assets and software licenses, and keep track of costs by mapping this information against contract details. Assets in the organization can be presented as a listing, enabling efficient asset usage.

Inventory module

In the Inventory module, you can check device information and software information for a managed device, and perform operations on the device.

Distribution (ITDM-compatible) module

In the Distribution (ITDM-compatible) module, you can distribute and install required software on computers, and uninstall redundant software. Required files can be distributed as well as software.

Note that this module cannot be used for distribution to agents for UNIX and Mac. Instead, use Remote Install Manager for the distribution to agents for UNIX and Mac.

Events module

In the Events module, you can check events that occurred during JP1/IT Desktop Management 2 operation.

Reports module

In the Reports module, you can view digest reports, security diagnostic reports, detailed security reports, detailed device reports, and detailed asset reports.

Settings module

In the Settings module, you can customize JP1/IT Desktop Management 2 settings such as user account settings and agent configurations. You can also search for devices and distribute agents from this module.

Related Topics:

1.3.2 Working with the Home module

1.3.3 Working with the Security module

1.3.4 Working with the Assets module

1.3.5 Working with the Inventory module

1.3.6 Working with the Distribution (ITDM-compatible) module

1.3.7 Working with the Events module

1.3.8 Working with the Reports module

1.3.9 Working with the Settings module

1.3.1 Basic module layout

The following describes the basic layout of the JP1/IT Desktop Management 2 modules and the terminology used for the module components.

Menu area

Menus are specific to the selected module. When you select an item here, corresponding information appears in the information area.

Information area

Displays information according to the item selected in the menu area.

Tabs

Tabs appear in the lower pane of the information area in the Security, Assets, Devices, and Distribution (ITDM-compatible) modules. Each tab shows detailed information relating to information selected in the upper pane.

Menu bar

The menus at the top of screen are common to all modules.

System

Logs the user out of JP1/IT Desktop Management 2.

View

Changes the panel layout, shows the display settings for the History back/forward buttons and check boxes, and initializes the display settings.

Go

Starts the Getting Started wizard and edits the user account of the logged-in user.

Help

Shows the operation window site map, license information, and version information for each product.

Log Out button

Logs the user out of JP1/IT Desktop Management 2. To the left of this button, the user ID of the logged-in user account appears. Click the user ID to edit your account information or change your password.

Help button

Describes the items in the open module and the operations you can perform from the module. To the left of this button, the name of the open module appears.

Buttons at the top of the window

These buttons allow you to access functions by switching to another module.

Related Topics:

1.3 Program modules

2.18.1 Information displayed in the operation windows in a multi-server configuration

1.3.2 Working with the Home module

In the Home module, each of the panels presents an overview of information managed by JP1/IT Desktop Management 2. You can see the general situation relating to devices, assets, and product licenses, and check for events and notifications. You can also monitor device discoveries and asset importation, and check database and hard disk statuses.

Tip

You can rearrange the panels by drag-and-drop operation. To change the panels displayed in the Home module or their basic layout, select Panel Layout in the View menu at the top of the screen.

After viewing the general situation, from the link in each panel you can navigate to another module and begin management tasks.

Related Topics:

2.2.1 List of Panels

1.3.3 Working with the Security module

In the Security module, you can create security policies (security rules). Once you assign security policies to computers, you can manage security throughout the system and take action if any computer is insecure. You can also manage operation logs and investigate suspicious operations, and check whether Windows updates have been applied.

The Security module provides the following views:

Overview view

Security Policies view

Computer Security Status view

Windows Update view

Operation Logs view

Each view is described next.

Overview view

The panels in this view provide a summary of the security of the managed computers in the organization.

Security Policies view

In this view you can create security policies and assign them to groups. By using computer policies you can manage the system security according to the assigned security rules.

Details about compliance with the security policy you select in the upper pane of the information area is shown in the tabs in the lower pane. You can check compliance with each security setting and take measures if any device has violated the security policy.

Computer Security Status view

In this view you can check the security of each computer, and send the user a message or enforce security measures if a computer violates the security policy. You can also assign security policies to individual computers.

Security compliance for the computer you select in the upper pane of the information area is shown in the tabs in the lower pane. You can check the computer's compliance with each security setting.

Windows Update view

In this view you can check whether Windows updates have been applied to computers. You can also manage the Windows updates that are required under the particular security policy and automatically distribute and apply Windows updates that have not been implemented.

Information about the Windows update you select in the upper pane of the information area is shown in the tabs in the lower pane. You can check whether the update is built into the security policy and identify computers where updates have not been applied.

Operation Logs view

In this view you can check the operation logs collected on the management server.

You can view a listing of operation logs and investigate suspicious operations. You can track file movements to and from the system and identify the computers involved, enabling early detection and response to information leaks.

This view appears only if operation logs are being acquired on the management server.

1.3.4 Working with the Assets module

In the Assets module, you can collectively manage the devices, software licenses, contracts and so on managed in the organization. You can manage each type of asset in listings like a ledger. By defining relationships among asset information, you can immediately see what contracts are linked to devices and how software licenses are being used, helping to perform asset management tasks more efficiently.

The Assets module provides the following views:

Overview view

Hardware Assets view

Software Licenses view

Managed Software view

Software License Status view

Contracts view

Each view is described next.

Overview view

The panels in this view provide a summary of the asset information managed by JP1/IT Desktop Management 2.

Hardware Assets view

In this view you can manage information about hardware assets in the organization such as computers, printers, and networking equipment. You can also map this information against contract details. By defining these relationships, you can immediately see the contract cost and contract period of hardware contracts.

Details about the hardware assets selected in the upper pane of the information area is shown in the tabs in the lower pane. You can check the contracts associated with a hardware asset, related assets, associated devices, and other information.

When hardware asset information is mapped against device information, the Device Information area is updated automatically whenever new device information is collected.

Software Licenses view

In this view you can manage information about software licenses your organization has purchased. You can also give users permission to use a particular software product by assigning a software license to a computer.

Details about the software licenses assets selected in the upper pane of the information area is shown in the tabs in the lower pane. You can check the contract period for a software license, see which computers are allocated a particular license, and so on.

Managed Software view

In this view you can manage information about managed software (software for which JP1/IT Desktop Management 2 keeps track of licenses). By registering managed software, the system is able to keep track of the number of software licenses that are in use, providing a clear picture of how software is being used. If you also register software license information, the system can keep track of the number of software licenses purchased for each piece of managed software, and see how many of those licenses are in use. This makes you aware of the managed software for which you have too few licenses, and those for which you have a surplus.

Details about the managed software selected in the upper pane of the information area is shown in the tabs in the lower pane. You can view a list of computers with the software installed, computers allocated a software license, software licenses associated with the software, and other information.

Software License Status view

In this view you can check the usage of software licenses for each managed software product. This view shows the number of owned software licenses, the number of remaining software licenses, and other information by license type and by department. This makes you aware of the managed software products that have too few licenses, and those that have excess licenses.

Details about the managed software selected in the upper pane of the information area is shown in the tabs in the lower pane. You can view a list of computers with the software installed, computers allocated a software license, software licenses associated with the software, and other information.

Contracts view

In this view you can manage contract information in relation to hardware assets and software licenses. By adding contract information, you can gain a clear picture of the costs and contract periods associated with asset contracts.

Details about the contract selected in the upper pane of the information area is shown in the tabs in the lower pane. You can check the software licenses, hardware assets, and other items associated with the selected contract.

1.3.5 Working with the Inventory module

In the Inventory module, you can check the current status of managed devices by viewing device information, installed software information, and other information. If the agent is installed on a computer, you can turn the computer on or off from the Inventory module and send messages to the user.

The Inventory module provides the following views:

Overview view

Device Inventory view

Revision History view

Software Inventory view

Each view is described next.

Overview view

The panels in this view provide a summary of the devices and software managed by JP1/IT Desktop Management 2.

Device Inventory view

In this view, you can view information about managed devices, check whether a device is on or off, and so on. You can also perform operations on managed devices, such as sending messages to users, turning computers on and off, and controlling computers remotely.

Details about the device you select in the upper pane of the information area is shown in the tabs in the lower pane. This includes system information, hardware information, information about installed software, and security information.

Revision History view

This view displays changes in the configuration of managed devices, including the CPU, memory, and IP addresses. By checking the revision history, you can easily find invalid configuration changes.

Software Inventory view

In this view, you can manage software installed on managed computers. This allows you to view a list of computers on which a particular software product is installed, designate software as prohibited software in a security policy, and so on.

Details about the software you select in the upper pane of the information area is shown in the tabs in the lower pane. This includes software information and a list of computers on which the software is installed.

1.3.6 Working with the Distribution (ITDM-compatible) module

In the Distribution (ITDM-compatible) module, you can distribute and install required software on managed computers, uninstall redundant software, and so on. Besides software, you can also distribute individual files.

Note that the Distribution (ITDM-compatible) module cannot be used for distribution to agents for UNIX or Mac. Instead, use Remote Install Manager for the distribution to agents for UNIX or Mac.

The Distribution (ITDM-compatible) module provides the following views:

Overview view

Packages view

Tasks view

Each view is described next.

Overview view

The panels in this view show the status of tasks and a list of tasks where errors have occurred.

Packages view

You can manage the packages that encapsulate distributed software and files. In this view, you can add and edit packages, and rerun or suspend package distribution operations.

You can also open a wizard that guides you through the process of installing or uninstalling software and distributing files.

Details about the package you select in the upper pane of the information area is shown in the tabs in the lower pane. You can check package information, tasks that distribute packages, and so on.

Tasks view

You can manage tasks that distribute packages and uninstall software, among others. In this view, you can add and edit tasks, and rerun or cancel tasks.

Details about the task you select in the upper pane of the information area is shown in the tabs in the lower pane. You can view task information, task statuses, package information and so on.

1.3.7 Working with the Events module

In the Events module, you can check events that occurred during JP1/IT Desktop Management 2 operation. Events include activity such as security judgment and device discovery ending normally.

You can view an event in detail by clicking the link in Description.

Some events require a quick response. Attend to Critical events first, followed by Warning events. Identify the cause of the event from the event details, and take the appropriate action.

When you have finished dealing with an event, change its status to Ack. By changing the event status, you can easily identify whether an event has been resolved.

1.3.8 Working with the Reports module

In the Reports module, you can view information about managed devices, the security status of computers, and other information in the form of a report. Reports can also be printed and used as official documents.

Examples of reports are shown below.

Daily Summary report

This report displays the status of events, the number of assets scheduled to undergo a status change, the status of software licenses, the status of distribution tasks, and other information for a specific day.

Current Diagnosis report

This report shows the results of diagnosing the current security status.

1.3.9 Working with the Settings module

In the Settings module, you can customize JP1/IT Desktop Management 2 settings such as user account settings and agent configurations. You can also search for devices and distribute agents from this module.

Each view of the Settings module is described next.

Settings List view

Lists the operations available in the Settings module. From this view, you can navigate to each view of the Settings module and customize the environment.

Product Site Map view

Lists the main components of the user interface provided by JP1/IT Desktop Management 2. You can go directly to a particular view by clicking the corresponding link. The Product Site Map view is useful if you need to access a particular view and are unsure of its location.

Views in the Settings module

User Management view

You can add, edit, and delete JP1/IT Desktop Management 2 user accounts.

Agent view

You can create and edit agent configurations and create installation sets. You can also distribute the agent software and assign agent configurations to agents.

Note that you cannot apply this view to agents for UNIX or Mac.

Discovery view

Operations you can perform in this view include setting search conditions for devices, and manually initiating device discovery. You can also start managing a device in JP1/IT Desktop Management 2 by designating it as a management target.

Network Access Control view

You can specify, by network segment, whether to permit newly discovered devices to connect to the network. You can also set linkages with JP1/NETM/NM - Manager and specify the settings related to the network control list.

Security view

You can schedule security assessments of managed computers. You can also specify settings related to the automatic import and export of operation logs, specify the version of the Windows OS you are using, and set security judgment for updates.

Assets view

You can set management items for asset information. You can also add, edit, and delete contract company information. If you import asset information from a CSV file, you can use this view to check the status and results of the import process.

Inventory view

You can add, edit, and delete conditions to be used when searching for software that does not appear in the Programs and Features list in Windows. You can also specify the settings for using AMT in JP1/IT Desktop Management 2 and for collecting revision histories. Furthermore, you can specify device maintenance conditions and perform detection.

Reports view

You can specify the retention period and start date for reports. You can also nominate a user as a recipient or a summary report.

Events view

You can select users to be notified when an event occurs, the type and severity of errors that generate a notification, and events for which no notification is issued.

General view

You can set up connections to the SMTP server, Active Directory, support services, and MDM systems.

Product Licenses view

You can view license information for JP1/IT Desktop Management 2 and register additional licenses.

2 Features of JP1/IT Desktop Management 2

This chapter explains the details of JP1/IT Desktop Management 2 features.

2.1 List of features

Tip

For JP1/IT Desktop Management 2 - Operations Director, some functions in the following lists are not supported. For details, see A.13 Functional restrictions in JP1/IT Desktop Management 2 - Operations Director.

Feature

Description

System summary

You can use the home module and dashboards to view the status of the system from a variety of perspectives.

User account management

By setting permissions, task allocations, and administration scopes, you can create user accounts suited to the role and responsibilities of each administrator who manages JP1/IT Desktop Management 2.

Setup wizard

A wizard is provided that guides you through the process of setting up JP1/IT Desktop Management 2.

Agent installation

You can register a user's computer as a management target of JP1/IT Desktop Management 2 by installing the agent program on the computer. This allows you to use the features of JP1/IT Desktop Management 2 to manage that computer.

There are several ways to install the agent. For example, an administrator can install the agent program manually, or you can distribute the program automatically from a management server.

Device management

When a device becomes a management target, you can use the features of JP1/IT Desktop Management 2 to manage the device. These include collecting and displaying device information, and monitoring and controlling whether devices are on or off. Managed devices can also be assessed against a security policy and contribute data to reports. Note that agents for UNIX or Mac are excluded from the power management.

You can use the search function and network monitoring function to discover the devices in your organization and automatically designate them as management targets.

Remote control

You can use the controller program to access the desktop of a user's computer and control it remotely. You can also use this program to send and receive files, record and play back screen activity, and chat with users. Note that agents for UNIX are excluded from the remote operation. In addition, for a computer running Linux or Mac OS, only remote control via RFB connections can be used.

Network connection management

JP1/IT Desktop Management 2 can monitor the network, preventing access by unauthorized devices and automatically isolating computers that are identified as a security risk. Enabling or disabling network connections of agents for UNIX must be performed manually.

Security management

You can determine the security status of the computers in your organization by creating a security policy to assess them against.

You can also implement security measures automatically and remotely on computers that might pose a security risk, and send messages notifying users of potential issues. Note that agents for UNIX are excluded from the security status assessment based on security policy, and from automatic countermeasure enforcement in response to a security-related problem. Agents for Mac are excluded from the automatic countermeasure enforcement in response to a security-related problem.

Operation log management

You can acquire operation logs that record the history of tasks a user has performed, and view this information in the operation window.

This feature allows you to scrutinize the log data closely when suspicious operations are detected that might lead to information being disclosed. Note that agents for UNIX or Mac are excluded from the collection of operation log data.

Asset management

You can manage the operating status of your system by keeping an inventory of the hardware assets and software licenses in your organization. There are two asset information management methods provided by JP1/IT Desktop Management 2.

Managing assets by using Asset Console

You use Asset Console to manage assets. This is recommended if you want to manage asset information in more detail than when you use the JP1/IT Desktop Management 2 operation window: for example, if you want to customize an asset information search window, or manage asset information that uses Items.

Managing assets using the JP1/IT Desktop Management 2 operation window

Use the JP1/IT Desktop Management 2 - Manager operation window (Assets module) to manage assets. This is recommended when you want to manage assets easily by using information collected by JP1/IT Desktop Management 2.

Software and file distribution

Administrators can distribute software and files on users' computers without needing to be on site. Distribution can be performed in the following two ways:

Distribution using Remote Install Manager

You use Remote Install Manager for distribution. In this way, you can specify detailed conditions and operations on the distribution-destination computer. You can also use commands to distribute the software and files managed by Remote Install Manager. The commands enable regular distribution using a batch file or automatic distribution in response to a specific event linking with JP1/AJS. This type of distribution is recommended if you want to specify detailed distribution conditions, or if you want to perform distribution every day.

Distribution using the operation window (ITDM-compatible distribution)

You use Distribution (ITDM-compatible) modules of the operation window for distribution. Unlike distribution using Remote Install Manager, you cannot specify detailed conditions or operations. Instead, you can let the installer automatically install MSI-file-based software on the distribution-destination computer with simple steps using a wizard. You can also uninstall some of the software installed on a user's computer. This type of distribution is recommended when you want to distribute software with an MSI-file installer a few times in a week or month.

Distribution using Remote Install Manager and ITDM-compatible distribution are different functions. Therefore, the data for a function can only be used by that function. For example, software managed by Remote Install Manager cannot be distributed using ITDM-compatible distribution.

Note that you must use Remote Install Manager to distribute data to agents for UNIX or Mac and to check the execution status.

Priority distribution

Specifies the priority of a package when packaging.

File collection

You can collect files stored in users' computers. You can collect data (created by users) and error logs (output by software used by users) in a single operation.

Note that files cannot be collected from agents for Mac OS.

Event viewer

You can view events that record the nature and results of actions performed by JP1/IT Desktop Management 2 features.

Report viewer

You can display all manner of reports describing aspects of your system such as the overall system status, the results of security diagnoses, power savings, and asset costs.

Filters

You can use filters to refine the information displayed in the modules. You can also save filter conditions for later use.

Management of a large system comprised of multiple departments or networks

You can install multiple management servers depending on the scale and network configuration of the system to be managed, to perform load distribution among administrators or management servers, or support operation in a NAT environment.

Use in cluster systems

You can use JP1/IT Desktop Management 2 in a cluster system.

Database management

You can use the database manager provided by JP1/IT Desktop Management 2 to back up and maintain the database.

Command line interface

You can use commands to perform a variety of tasks, such as importing and exporting management information and backing up and maintaining the database.

Operations on user computers

Users of managed computers will sometimes interact with JP1/IT Desktop Manager on their computers. Note that for agents for UNIX or Mac OS, messages received from the management server cannot be viewed, and user information cannot be entered.

Smart device control

By linking with an MDM system, JP1/IT Desktop Management 2 can lock, wipe, and otherwise control smart devices.

Management of computers via the Internet

You can manage users' computers connected via the Internet. The management of computers is possible not only when the management server and users' computers are connected to one another by using VPN but also when a VPN connection is not used.

2.2 Displaying a system summary

JP1/IT Desktop Management 2 provides a Home module and dashboards that provide administrators with a concise overview of the system being managed. In addition to providing a system overview, these panels allow administrators to drill down through items of interest for a more in-depth view.

Home module

The Home module is the main window of JP1/IT Desktop Management 2 that appears when you log in. This module displays the information administrators need to know for the day-to-day running of the system, based on the most recent information available. This means that a quick visit to the Home module is all administrators need to gain an overview of the status of the system in general. Also, administrators can view more detailed information about an aspect of the system by clicking the items in the module.

System Summary panel

The System Summary panel presents an outline of the status of managed devices.

Device Status

Displays the number of devices designated at-risk. The administrator can then check the security status of at-risk devices and take action where needed. This panel also displays the number of discovered nodes, the number of managed nodes, and the number of computers without the agent program installed.

Asset Status

Shows the number of hardware assets whose status is Unconfirmed. The administrator can then check each asset to find out whether it is in use, in stock, or has been disposed of. This panel also shows the number of managed hardware assets.

Connection Status

Shows the number of new devices that have connected to the network in the past week. This includes newly discovered devices and devices made management targets by installation of the agent program. This panel also shows the number of assets that have not been seen on the network in more than a month.

License Information

Shows the number of JP1/IT Desktop Management 2 licenses that are in use, and the number of licenses in surplus. Administrators can use this information to plan the purchase of additional licenses by monitoring trends in device and asset numbers. In a multi-server configuration, this information is not displayed on the operation window of a management relay server of which you do not own a license.

Note that the number of licenses are the total number of licenses that are registered (including licenses for Windows, Linux, and UNIX agents if any). Furthermore, the difference obtained by subtracting the number of licenses for UNIX and Linux from the total number of licenses includes both licenses for Windows and those for Mac OS. For example, if the total number of licenses is 150 and the number of licenses for UNIX and Linux is 50, the difference obtained by subtracting 50 from 150 (i.e., 100 licenses) includes both licenses for Windows and those for Mac OS.

Category Security Assessment panel

Shows a graph evaluating the security status of managed computers. By viewing the graph as a whole or focusing on individual categories, you can identify points of weakness and take action accordingly.

Background Task panel

Shows the status of tasks such as importing asset information, operation log manual retrieval, agent distribution, and device discovery. You can use this panel to view the results of completed tasks, or identify the cause of any errors and take actions accordingly.

Not Ack Event Summary panel

Shows the number of events that are yet to be acknowledged, and how many of those events have a severity level of critical or warning. This allows administrators to quickly identify and respond to critical events in particular. You can identify the presence of a critical event from the icon that appears to the left of the event type.

Topic panel

This panel shows important notices issued in the course of JP1/IT Desktop Management 2 operation. Always read the notices in this area, and respond quickly when made aware of a problem. Examples of the notifications in this area are as follows:

A data folder has insufficient free space

A software product has exceeded the number of available licenses

A contract has expired

DB and Disk Usage panel

Shows the status of database backup and reorganization tasks, and the amounts of used and available hard disk space. Based on this information, you can move the database backup folder from a nearly full disk to one with enough free space, or free up disk space by removing data that is no longer needed.

Dashboards

A dashboard is the first window that appears when you select an item in the menu at the top of the operation window. Like the home module, each dashboard displays panels in which you can monitor the status of various functions. As an example, the dashboard of the Security module is shown below.

The Security module, Assets module, Inventory module, and Distribution (ITDM-compatible) module each have their own dashboard.

Tip

You can customize the panels displayed in the Home module and the various dashboards. To customize the layout, from the View menu at the top left of the window, select Panel Layout. In the dialog box, select a panel layout and select the panels you want to display.

2.2.1 List of Panels

The following table lists the panels displayed in the home module, and in the Summary view and Dashboard view of each module.

Category

Panel name

Description

Home

Hierarchical Configuration Under the Local Server and Operation Status

Shows the hierarchic configuration of the system referenced from the local server, and the operation status of the management relay server under the local server. You can also start the operation window, check the device information, and perform remote operation of the management relay server under the local server.

System Summary

Shows the status of managed devices, statuses of assets and connections, and license information. You can also view trends in the number of devices and assets.

Background Task

Shows the status of tasks such as asset information importation, operation log manual retrieval, agent distribution, and device discovery. If an error is reported, view the error details and take action accordingly.

Not Ack Event Summary

Shows how many events that occurred within a specific time period have not been acknowledged. We recommend that you use this panel as the starting point for viewing and resolving events whose severity is Critical.

Topic

Shows the notifications that were issued within a specified time period. This panel lets you know when a contract has expired, when there is an insufficient number of licenses for a product, and other important information.

DB and Disk Usage

Shows when the JP1/IT Desktop Management 2 database is last backed up and reorganized, and the amounts of used and available disk space.

Security

Category Security Assessment

Shows the overall security status of managed computers on a scale from A to E, and a chart showing security performance in individual categories. This panel also shows how the security status compares to the previous day. This allows you to monitor the effectiveness of security measures and make adjustments where necessary.

No. of Devices by Violation Level

Shows the total number of managed devices, the number of devices at each violation level, and a graphical representation of violation levels across the system. Use this panel to quickly identify devices with a high violation level and take the appropriate action.

Suspicious Operations

Shows the number of suspicious operations (related to data disclosure) detected by JP1/IT Desktop Management 2. You can access the operation log for the suspicious action by clicking a link. We recommend that you use this feature to find out whether any data might have been leaked.

Security Status by Policy

This panel shows the overall security status of the system, and the security status in terms of individual security policies. If a security policy has a low rating, identify the computers that violate the policy and take remedial action.

Assets

Hardware Assets Trend

This panel shows trends in the number of hardware assets in each category. For example, you might notice an increase in hardware assets in In Stock status and decide to start disposing of older hardware.

Customized HW Assets (Group/Filter)

This panel shows the number of hardware assets for each custom group and filter condition. For example, by defining a custom group or filter that displays hardware assets with an early purchase date, you can quickly identify hardware assets that might need replacing.

Expired Contracts (next 3 months)

For each contract type, this panel shows the number of expired contracts and the number of contracts that are expiring soon. By clicking the links in this panel, you can identify contracts that are about to expire and plan a course of action.

Software (License Violation)

This panel allows you to instantly see the pieces of managed software for which you have too few licenses, and those for which you have a surplus. If this panel shows that you have more instances of a product installed than you have licenses for the product, you can take action such as directing users to uninstall the software or purchasing additional licenses.

Inventory

Managed Nodes Trend

This panel shows trends in the number of devices in each agent installation status. For security reasons, we recommend that you install the agent program on computers managed by JP1/IT Desktop Management 2. Use this panel to identify computers that do not have the agent program installed, and install the program as needed.

Customized Device Inventory (Group/Filter)

This panel shows the number of managed devices for each custom group and filter condition. For example, by defining a custom group or filter that displays devices that have not been used for a certain period of time, you can quickly identify hardware assets that can be declared idle.

No. of Devices by OS

This panel shows the proportion of each OS on managed computers, and how many instances of each OS are in your system.

New Software

This panel lists new software information collected from managed computers. Check this list regularly. If you discover non-business related software in the list, you can register it as prohibited software. You can also use this information when deciding whether to manage license information for a particular piece of software. Note that you can use the software type as a criterion when you want to decide whether to manage software licenses. For example, you can manage licenses for only the software with the commercial software license.

Distribution (ITDM-compatible)

Task Status

This panel shows the status of tasks executed by administrators, and those executed as part of the automatic enforcement of a security policy. We recommend that you view the Error Task Status panel if you only want to see tasks where errors have occurred.

Error Task Status

This panel shows the status of tasks where errors have occurred. Identify the cause of the error, take the appropriate action, and then re-execute the task. To view the status of tasks in general, we recommend that you use the Task Status panel.

2.3 Managing user accounts

If several administrators will be using JP1/IT Desktop Management 2, you can create a user account in JP1/IT Desktop Management 2 for each administrator.

You can set the following parameters for user accounts that define the range of operations the user can perform, and the scope of the information available to the user. By creating user accounts with the appropriate combinations of these parameters, you can ensure a proper division of responsibilities and effective internal controls among the administrators of a system.

Permission

Set permissions appropriate to the range of operations the user performs. For example, you might have a manager who only needs read-only access to information, a system administrator who manages devices and assets, and a system administrator who manages user accounts.

Task allocation

You can restrict permissions further by limiting users to certain tasks such as security management, asset management, or device management.

Administration scope

You can create user accounts in a manner that limits the information available to users at the department level. For example, users in the general affairs, sales, and research departments might have access to different information.

Manipulation of operation windows used for distribution using Remote Install Manager, such as Remote Install Manager and Packager, is allowed only for users who are given distribution management task allocation and system management authority in the user account settings.

The following figure shows an example of creating user accounts with separate parameters for each administrator.

Users with user management permission are able to add, edit, and delete user accounts.

Add and delete user accounts when changes are made to the users who use JP1/IT Desktop Management 2 in your organization. Edit user accounts when changes to the management structure require changes to account passwords or permissions. User account passwords must be changed regularly. When a password approaches its expiration date, only the owner of the account or an administrator with user management permission can change the password.

Tip

A user with user management permission can unlock user accounts and reset passwords when a user is locked out or forgets his or her password.

2.3.1 Locking user accounts

You can specify that a user's account is to be locked when the user fails to log in to JP1/IT Desktop Management 2 a predetermined number of times. That user cannot log in again until the user account is unlocked.

You can specify the number of failed attempts before a user account is locked, in the Other Settings view in the setup window.

You can find out whether any accounts are locked by accessing the Account Management view in the Settings module from a user account with user management permission. You can then use the same view to unlock the account.

Disabled appears as the Status of locked user accounts in the Account Management view.

Tip

If there are no accounts with user management permission, unlock the account by restarting the management server.

2.3.2 Authentication methods for user accounts

There are two methods for authenticating JP1/IT Desktop Management 2 user accounts: ITDM2 authentication and JP1 authentication.

Important

You must use the same authentication method for all user accounts. (You cannot use ITDM2 authentication and JP1 authentication at the same time.)

ITDM2 authentication

This method authenticates user accounts within the JP1/IT Desktop Management 2 system. User accounts are created in the JP1/IT Desktop Management 2 operation window and managed by JP1/IT Desktop Management 2 - Manager. This is the standard method for authenticating user accounts in a JP1/IT Desktop Management 2 system.

The following figure shows how ITDM2 authentication works.

JP1 authentication

This method uses JP1/Base for integrated management and authentication of user accounts. User accounts (JP1 users) are created in JP1/Base and managed by using an authentication server. If you are using JP1 authentication for another JP1 product, you can use the user accounts of that product. If you are using JP1/IM, you can link JP1/IM with the email notification function.

The following three programs use JP1 authentication:

JP1/IT Desktop Management 2 - Manager operation window

Remote Install Manager

Packager

Important

If you use JP1 authentication, you cannot set an administration scope.

The following figure shows how JP1 authentication works.

2.3.3 User account permissions

There are four permissions you can assign to user accounts in JP1/IT Desktop Management 2:

System administrator permission

A user with this permission has full access to the features of JP1/IT Desktop Management 2, with the exception of user account management. He or she can perform any operation except adding, editing, or deleting a user account.

User management permission

A user with this permission is able to manage JP1/IT Desktop Management 2 user accounts. He or she can add, edit, or delete a user account.

View permission

A user with this permission is able to view the information managed by JP1/IT Desktop Management 2. Users are assigned view permission by default.

API permission

A user with this permission is able to use JP1/IT Desktop Management 2 via the API.

Important

System administrator permission, user management permission, and view permission cannot be set together with API permission. This means that when you assign API permission to a user account, you cannot assign any other permissions to the same user account.

Users having a user account with API permission assigned to it cannot log in to the operation windows of JP1/IT Desktop Management 2.

Email notifications cannot be sent to user accounts to which API permission is assigned.

Only administrators with user management permission can change the passwords for user accounts to which API permission is assigned.

Only administrators with user management permission can unlock user accounts to which API permission is assigned.

2.3.4 Available operations by user account permission

The permission assigned to a user account determines the modules the user can access and the tasks the user can perform. The following table shows the operation windows and ranges of operations available to user accounts for each permission when task allocations and administration scopes are not limited.

Operation window

Permission

System administrator permission

User management permission

View permission

API permission

Getting Started wizard

Y

N

N

N

Home module

Y

Y*

Y*

N

Security module

Y

Y*

Y*

N

Assets module

Inventory module

Distribution (ITDM-compatible) module

Events module

Reports module

Settings module

User Management view

N

Y

N

N

Windows other than User Management view

Y

N

N

N

Print reports and security policies

Y

N

View help

Y

N

Legend: Y: Can operate. Y*: Can view only. N: Cannot operate or view.

2.3.5 Task allocations for user accounts

In JP1/IT Desktop Management 2, you can assign task allocations to user accounts according to the role of the administrator who uses the account. By setting up user accounts with the appropriate combination of task allocations and permissions, you can limit the operations an administrator can perform to those suited to his or her role. This promotes stronger internal controls because administrators can only manage information related to their field of responsibility.

There are five task allocations:

Security management

Limits the user to tasks such as editing and applying security policies, applying security measures to devices according to their violation level, and managing and applying program updates. Because the application of security measures involves the distribution of software and program updates, a user assigned this task allocation is automatically allocated distribution management tasks.

Asset management

Limits users to tasks related to the management of asset information such as the equipment held by the organization, software licenses, and contracts.

Device management

Limits users to tasks such as the management of device information, remote control of devices, and managing installed software.

Distribution management

Limits users to tasks related to the distribution of software and files. A user who is allocated the distribution management and security management tasks can also distribute program updates.

System configuration management

Limits users to the management of configuration information for JP1/IT Desktop Management 2, such as configuring device search parameters, setting up agents, setting network control, and other tasks. Because these settings are essential to the running of JP1/IT Desktop Management 2, users with this task allocation must have system administrator permission. To add, edit, or delete user accounts, the user must also have user account management permission.

The following figure shows an example of assigning task allocations to user accounts according to the administrator's field of responsibility:

System management coordinator

A user responsible for coordinating overall system management. Because the system management coordinator is responsible not only for reviewing the task allocations of each management user, but also for managing all manner of JP1/IT Desktop Management 2 settings including operating procedures and user accounts, he or she must be assigned all task allocations.

Management user

A user responsible for day-to-day management of the system. Management users should only be assigned task allocations that are relevant to their fields of responsibility.

Important

Tasks cannot be allocated to user accounts to which API permission is assigned.

2.3.6 Available operations by task allocation

By assigning task allocations to a user account, you can limit the modules and menus available to the user and the tasks the user can perform. The range of available operations is determined from the user's permissions and task allocations.

Important

In some cases, a module or menu accessible under a given task allocation contains items that are within the scope of a different task allocation. In this case, the user might be unable to display a particular module or perform a particular operation unless also assigned a task allocation that makes the item available. For example, the Go to Device List button does not appear on the Asset Information tab of the Asset List area in the Asset module for users who are only assigned the asset management task allocation. This is because operations in the Device List view are within the scope of the device management task allocation. If an administrator needs to view the Device List view in the course of his or her work, the user account must be assigned the device management task allocation in addition to asset management.

Tip

If you assign an administration scope in addition to a task allocation, the information available within the scope of the task allocation is further restricted based on the department for which the administrator is responsible.

The following table shows the range of available user operations for each operation window, according to task allocation and permission.

The legend for the tables in this section is as follows:

Legend: Y: Can operate. Y*: Can view only. N: Cannot operate or view.

With security management set as task allocation

Operation window

Menu

Permission

System administrator permission

User management permission

View permission

Getting Started wizard

None

N

N

N

Home module

None

Y

Y

Y

Security module

Overview

Y

Y

Y

Security Policies

Y

Y*

Y*

Computer Security Status

Y#1

Y*

Y*

Windows Update

Y

Y*

Y*

Operation Logs

Y

Y*

Y*

Assets module

All menus

N

N

N

Inventory module

All menus

N

N

N

Distribution (ITDM-compatible) module

Overview

Y

Y

Y

Packages

Y

Y*

Y*

Tasks

Y

Y*

Y*

Events module

Events

Y

Y*

Y*

Reports module

Overview

Y #2

Y #2

Y #2

Summary Reports

Y

Y

Y

Security Diagnosis Reports

Y

Y

Y

Security Detail Reports

Y

Y

Y

Inventory Detail Reports

N

N

N

Asset Detail Reports

N

N

N

Settings module

Overview

Y #3

Y #3

N

User Management

N

Y

N

Agent

N

N

N

Device Discovery

N

N

N

Network Access Control

N

N

N

Security

Y

N

N

Assets

N

N

N

Inventory

N

N

N

Reports

N

N

N

Events

N

N

N

General

N

N

N

Product Licenses

N

N

N

#1: To edit the groups displayed in the device list, the following task allocations must be assigned.

To edit device types, networks, and user definitions: Device management task allocation

To edit departments and locations: Asset management task allocation

#2: Only an administrator with all task allocations can view or operate this item.

#3: The settings list is not displayed.

With asset management set as task allocation

Operation window

Menu

Permission

System administrator permission

User management permission

View permission

Getting Started wizard

None

N

N

N

Home module

None

Y

Y

Y

Security module

All menus

N

N

N

Assets module

Overview

Y

Y

Y

Hardware Assets

Y

Y*

Y*

Software Licenses

Y

Y*

Y*

Managed Software

Y

Y*

Y*

Software License Status

Y

Y*

Y*

Contracts

Y

Y*

Y*

Inventory module

All menus

N

N

N

Distribution (ITDM-compatible) module

All menus

N

N

N

Events module

Events

Y

Y*

Y*

Reports module

Overview

Y #1

Y #1

Y #1

Summary Reports

Y

Y

Y

Security Diagnosis Reports

N

N

N

Security Detail Reports

N

N

N

Inventory Detail Reports

N

N

N

Asset Detail Reports

Y

Y

Y

Settings module

Overview

Y #2

Y #2

N

User Management

N

Y

N

Agent

N

N

N

Device Discovery

N

N

N

Network Access Control

N

N

N

Security

N

N

N

Assets

Y

N

N

Inventory

N

N

N

Reports

N

N

N

Events

N

N

N

General

N

N

N

Product Licenses

N

N

N

#1: Only an administrator with all task allocations can view or operate this item.

#2: The settings list is not displayed.

With device management set as task allocation

Operation window

Menu

Permission

System administrator permission

User management permission

View permission

Getting Started wizard

None

Y

N

N

Home module

None

Y

Y

Y

Security module

All menus

N

N

N

Assets module

All menus

N

N

N

Inventory module

Overview

Y

Y

Y

Device Inventory

Y#1

Y*

Y*

Revision History

Y

Y*

Y*

Software Inventory

Y

Y*

Y*

Distribution (ITDM-compatible) module

All menus

N

N

N

Events module

Events

Y

Y*

Y*

Reports module

Overview

Y #2

Y #2

Y #2

Summary Reports

Y

Y

Y

Security Diagnosis Reports

N

N

N

Security Detail Reports

N

N

N

Inventory Detail Reports

Y

Y

Y

Asset Detail Reports

N

N

N

Settings module

Overview

Y #3

Y #3

N

User Management

N

Y

N

Agent

Y

N

N

Device Discovery

Y

N

N

Network Access Control

N

N

N

Security

N

N

N

Assets

N

N

N

Inventory

Y

N

N

Reports

N

N

N

Events

N

N

N

General

N

N

N

Product Licenses

N

N

N

#1: To edit departments and locations in the groups displayed in the device list, asset management task allocation must be assigned.

#2: Only an administrator with all task allocations can view or operate this item.

#3: The settings list is not displayed.

With distribution management set as task allocation

Operation window

Menu

Permission

System administrator permission

User management permission

View permission

Getting Started wizard

None

N

N

N

Home module

None

Y

Y

Y

Security module

All menus

N

N

N

Assets module

All menus

N

N

N

Inventory module

All menus

N

N

N

Distribution (ITDM-compatible) module

Overview

Y

Y

Y

Packages

Y

Y*

Y*

Tasks

Y

Y*

Y*

Events module

Events

Y

Y*

Y*

Reports module

Overview

Y #1

Y #1

Y #1

Summary Reports

Y

Y

Y

Security Diagnosis Reports

N

N

N

Security Detail Reports

N

N

N

Inventory Detail Reports

N

N

N

Asset Detail Reports

N

N

N

Settings module

Overview

N

Y #2

N

User Management

N

Y

N

Agent

N

N

N

Device Discovery

N

N

N

Network Access Control

N

N

N

Security

N

N

N

Assets

N

N

N

Inventory

N

N

N

Reports

N

N

N

Events

N

N

N

General

N

N

N

Product Licenses

N

N

N

#1: Only an administrator with all task allocations can view or operate this item.

#2: The settings list is not displayed.

With system configuration management set as task allocation

Operation window

Menu

Permission

System administrator permission

User management permission

Getting Started wizard

None

Y

N

Home module

None

Y

Y

Security module

All menus

N

N

Assets module

All menus

N

N

Inventory module

All menus

N

N

Distribution (ITDM-compatible) module

All menus

N

N

Events module

Events

Y

Y*

Reports module

Overview

Y #1

Y #1

Summary Reports

Y

Y

Security Diagnosis Reports

N

N

Security Detail Reports

N

N

Inventory Detail Reports

N

N

Asset Detail Reports

N

N

Settings module

Overview

Y

Y #2

User Management

N

Y

Agent

Y

N

Device Discovery

Y

N

Network Access Control

Y

N

Security

Y

N

Assets

Y

N

Inventory

Y

N

Reports

Y

N

Events

Y

N

General

Y

N

Product Licenses

Y

N

#1: Only an administrator with all task allocations can view or operate this item.

#2: The Settings List is not displayed.

With no task allocations set

Operation window

Menu

Permission

System administrator permission

User management permission

View permission

Getting Started wizard

None

N

N

N

Home module

None

Y

Y

Y

Security module

All menus

N

N

N

Assets module

All menus

N

N

N

Inventory module

All menus

N

N

N

Distribution (ITDM-compatible) module

All menus

N

N

N

Events module

Events

Y

Y*

Y*

Reports module

Overview

N

N

N

Summary Reports

Y

Y

Y

Security Diagnosis Reports

N

N

N

Security Detail Reports

N

N

N

Inventory Detail Reports

N

N

N

Asset Detail Reports

N

N

N

Settings module

Overview

N

Y #

N

User Management

N

Y

N

Agent

N

N

N

Device Discovery

N

N

N

Network Access Control

N

N

N

Security

N

N

N

Assets

N

N

N

Inventory

N

N

N

Reports

N

N

N

Events

N

N

N

General

N

N

N

Product Licenses

N

N

N

#: The Settings List is not displayed.

With multiple task allocations set

When several task allocations are assigned to a user account, the available items are the items available to each task allocation combined. By way of example, the following table shows the scope of operations permitted for a user with the asset management and device management task allocations.

Operation window

Menu

Permission

System administrator permission

User management permission

View permission

Getting Started wizard

None

Y

N

N

Home module

None

Y

Y

Y

Security module

All menus

N

N

N

Assets module

Overview

Y

Y

Y

Hardware Assets

Y

Y*

Y*

Software Licenses

Y

Y*

Y*

Managed Software

Y

Y*

Y*

Software License Status

Y

Y*

Y*

Contracts

Y

Y*

Y*

Inventory module

Overview

Y

Y

Y

Device Inventory

Y

Y*

Y*

Revision History

Y

Y*

Y*

Software Inventory

Y

Y*

Y*

Distribution (ITDM-compatible) module

All menus

N

N

N

Events module

Events

Y

Y*

Y*

Reports module

Overview

N

N

N

Summary Reports

Y

Y

Y

Security Diagnosis Reports

N

N

N

Security Detail Reports

N

N

N

Inventory Detail Reports

Y

Y

Y

Asset Detail Reports

Y

Y

Y

Settings module

Overview

Y #

Y #

N

User Management

N

Y

N

Device Discovery

Y

N

N

Agent

Y

N

N

Network Access Control

N

N

N

Security

N

N

N

Assets

Y

N

N

Inventory

Y

N

N

Reports

N

N

N

Events

N

N

N

General

N

N

N

Product Licenses

N

N

N

#: The Settings List is not displayed.

2.3.7 Administration scopes for user accounts

You can assign an administration scope to a user account in JP1/IT Desktop Management 2 according to the department for which the administrator is responsible. When a company has more devices than a single administrator can manage, you can assign administrators to individual departments. When designated as a department administrator, an administrator can view and manage devices and hardware assets associated with that department.

Note that administration scope settings are not applied to distribution that uses Remote Install Manager.

The following figure shows an example of allocating administration scopes to user accounts for use by department administrators.

Administrator

Manages the systems for the entire organization. By using an account with no administration scope, an administrator can view information for all departments.

Department administrator

Manages the systems for a particular department. By using an account with an administration scope, a department administrator only has access to information for the department for which he or she is responsible.

Important

An administration scope cannot be assigned to user accounts to which API permission is assigned.

2.3.8 Differences in operation windows when administration scopes are assigned

When you use a user account that is limited to a particular administration scope, only the information applicable to that administration scope appears in the modules, and the operations you can perform are similarly restricted. The following table shows how the operation windows appear to users who are assigned a administration scope.

Operation module

Differences when administration scope is restricted

Home module

Home module

The following items do not appear:

welcome message

Getting Started button

Getting Started Wizard item in Go menu

System Summary panel

Used Licenses are not clickable links.

Not Ack Event Summary panel

Only information applicable to the administration scope appears.

Topic panel

Some messages are not clickable links. In addition, some messages only contain information applicable to the administration scope.

Background Task panel

The following items are not clickable links:

Error

IP Address Range

Active Directory

DB and Disk Usage panel

--

# of Devices by Violation Level panel

Only information applicable to the administration scope appears.

Security Status by Policy panel

--

Suspicious Operations panel

Only information applicable to the administration scope appears.

Customized Device Inventory (Group/Filter) panel

Only information applicable to the administration scope appears.

Customized HW Assets (Group/Filter) panel

Only information applicable to the administration scope appears.

Category Security Assessment panel

Only information applicable to the administration scope appears.

Hardware Assets Trend panel

--

Expired Contracts (next 3 months) panel

Only information applicable to the administration scope appears.

Software (License Violation) panel

Only information applicable to the administration scope appears.

# of Devices by OS panel

Only information applicable to the administration scope appears.

Managed Nodes Trend panel

--

New Software panel

--

Task Status panel

--

Error Task Status panel

Only information applicable to the administration scope appears.

Hierarchical Configuration Under the Local Server and Operation Status panel#1

The following items do not appear:

Change the Method of Judging the Operation Status in the Action menu

Delete the Management Relay Server in the pop-up menu displayed when you right-click the management relay server icon

Security module

Overview view#2

The range of information displayed depends on the panel.

Security Policies view

The administrator can view but not edit the information.

The tabs in the lower pane of the information area provide the same operations as when the administration scope is not restricted.

Computer Security Status view

Only information applicable to the administration scope appears.

The following items do not appear in the Action menu:

Assign Policy

Cancel Policy

Enable Network Access Control

Disable Network Access Control

Messages about disabled network monitors do not appear in the message bar.

Windows Update view

The administrator can view but not edit the information.

Update Information from Customer Support Offline does not appear in the Action menu.

Operation Logs view

Only information applicable to the administration scope appears.

Assets module

Overview view#2

The range of information displayed depends on the panel.

Hardware Assets view

Only information applicable to the administration scope appears.

Enable End User Form (Frequent Pop-up) does not appear in the Action menu.

In dialog boxes where hardware asset information can be added and edited, icons do not appear to the left of management items.

You cannot add new items to the dialog boxes.

Software License view

Only information applicable to the administration scope appears.

The Assigned Computers tab also displays information not applicable to the administration scope. This information can be used for removing software licenses that are no longer required in departments after department information has changed.

In dialog boxes where software license information can be added and edited, icons do not appear to the left of management items.

You cannot add new items to the dialog boxes, with the exception of the Managed Software Name item.

Managed Software view

Update Information from Customer Support Offline does not appear in the Action menu.

The Add as Unauthorized Software button does not appear on the Installed Software tab.

Software License Status view

Only information applicable to the administration scope appears.

Contracts view

Only information applicable to the administration scope appears.

In dialog boxes where contract information can be added and edited, icons do not appear to the left of management items.

You cannot add new items to the dialog boxes.

Devices module

Overview view#2

The range of information displayed depends on the panel.

Device Inventory view

Only information applicable to the administration scope appears.

The following items do not appear in the Action menu:

Enable End User Form (Frequent Pop-up)

Enable Network Access Control

Disable Network Access Control

Set Credentials

Report all Device Details to the Higher Management Server#3

Messages about disabled network monitors do not appear in the message bar.

In dialog boxes where device information can be edited, icons do not appear to the left of management items. You cannot add new items to the dialog boxes.

Revision History view

Only information applicable to the administration scope appears.

Software Inventory view

Remove Software and Update Information from Customer Support Offline do not appear in the Action menu.

The Add as Unauthorized Software button does not appear on the Installed Software tab.

Distribution (ITDM-compatible) module

Overview view#2

The range of information displayed depends on the panel.

Packages view

--

Tasks view

--

Events module

For events whose source is device information or asset information, only information applicable to the administration scope appears.

Some messages do not appear as links.

Reports module

Overview view

--

Summary Reports

--

Security Diagnosis Reports

Reports are limited to information gathered within the administration scope of the user.

Security Detail Reports

The following reports are limited to information gathered within the administration scope of the user:

Violation Level Status report

Windows Update Status report

Antivirus Software Status report

Mandatory Software Status report

Unauthorized Software Status report

Security Settings Status report

Inventory Detail Reports

Reports are limited to information gathered within the administration scope of the user.

Asset Detail Reports

Reports are limited to information gathered within the administration scope of the user.

Settings module

Overview view

Only the Product Site Map window appears.

User Management view

--

Agent view

In the Windows Agent Configurations and Create Agent Installers view, the user can only refer to the information.

In the Windows Agent Configurations Assignment view, only information applicable to the administration scope appears. At the top of the information area, the Change Target Group Type button can not view, and then Assign button and Cancel button are unavailable.

In the Windows Agent Deployment view, only the information in the administration scope appears. In the Settings of the Components of the Agents to Be Deployed area, the Edit button does not appear.

The Agentless Management view does not appear.

Device Discovery view

Only the following views can be displayed, and only information applicable to the administration scope appears in these views:

Discovered Nodes view

Managed Nodes view

Ignored Nodes view

Note that in the Discovered Nodes and Managed Nodes views, Set Credentials and Start Discovery do not appear in the Operation Menu.

Network Access Control view

Not displayed.

Security view

Not displayed.

Assets view

Only the Last Import Log view and the Asset Status Settings of Hardware Assets Associated with Deleted Devices view can be displayed. In the Asset Status Settings of Hardware Assets Associated with Deleted Devices view, the user can only refer to the information.

Inventory view

Only the Device Maintenance Settings and Detection Results view appears.

In the Detection Conditions for Device Maintenance dialog box, the user can only refer to the information.

In the Settings for Suppressing Device Maintenance and List of Devices Suggested for Deletion areas, only information applicable to the administration scope appears.

Reports view

Not displayed.

Events view

Not displayed.

General view

Not displayed.

Product Licenses view

Not displayed.

Legend: --: Restricting the administration scope has no effect.

#1: This panel is displayed in a multi-server configuration.

#2: The panels in the Overview view are the same as those in the Home module.

#3: This menu is displayed in the case of the management relay server.

Tip

If you log in using an account with a administration scope, you cannot edit the department information (the Department management item) that appears in the menu and other areas of each module.

2.4 Using the Getting Started wizard

When you log in to JP1/IT Desktop Management 2, you can access the Getting Started wizard by clicking the Getting Started button in the Home module. This wizard guides you through the initial stages of JP1/IT Desktop Management 2 operation.

By following the prompts in the wizard, you can create an installer file (installation set) for installing an agent on the computer. Executing this file on each computer installs the agent on each computer. For details, see the description on manually installing an agent in the JP1/IT Desktop Management 2 Configuration Guide.

You can also install an agent on a computer by Active Directory discovery and network discovery.

2.4.1 Discovering devices

You can search for devices connected to the network or registered in Active Directory for each management server.

Searching the network

You can search the network within a specified IP address range. You can also set authentication information, enabling JP1/IT Desktop Management 2 to gather information from devices as part of the search process.

If you do not have a clear picture of the devices deployed throughout your organization, you can gather the information you need by conducting a search. You can then plan agent deployment based on the results of the search process.

Searching Active Directory

If your organization uses Active Directory, you can search for computers registered in Active Directory. You can search multiple Active Directory servers if needed. The discovery process acquires information registered in Active Directory.

By registering the information obtained from Active Directory in JP1/IT Desktop Management 2, you can use the information in reports and to manage devices.

As part of the search process, you can automatically designate discovered devices as management targets, and automatically distribute the agent program to discovered computers. You can also configure the system to notify the administrator by email when a new device is discovered.

2.4.2 Discovering networked devices

You can search for devices connected to a network, and register discovered devices as management targets of JP1/IT Desktop Management 2.

You can search a specific range of network addresses for devices. You can register discovered devices such as computers that require security management as management targets, and devices such as routers that do not require security management as exclusion targets.

As part of the search process, you can automatically register discovered devices as management targets, and automatically distribute the agent program to discovered computers. You can also configure the system to notify the administrator by email when a new device is discovered.

The following figure shows an overview of searching for devices and registering discovered devices as management targets.

On the management server, search for devices on a routine basis by specifying a network range to search, a discovery schedule, and other parameters.

Important

To conduct an intensive search for devices in the network by specifying a discovery period, specify 50,000 or less IP addresses in the discovery range. If more than 50,000 IP addresses are contained, the search might stop.

If you discover more than 50,000 IP addresses, disable the Intensive Discovery option.

Tip

Management servers can connect to a maximum of 10 devices at once during a search.

Discovered devices can be registered as management targets automatically, or set aside to be manually registered as a management target or exclusion target at a later time.

Related Topics:

(1) Devices supported as management targets

(1) Types of device information you can collect

(2) Device status information that can be collected

(3) System information that can be collected

(4) Hardware information

(5) Installed software information

(6) Security information

(7) Shared management items for asset information and device information

(1) Discovery conditions

A.3 Port number list

(1) Discovery conditions

Several conditions must be met before you can discover devices. Each discovery method has different conditions.

Discovering devices in Active Directory

The correct settings must be specified for the connection-target Active Directory server in the Active Directory view under General in the Settings module.

Discovering networked devices

The following conditions must be satisfied:

If a device to be discovered is in the same segment as the management server, the device must respond to ARP requests from the management server.

If a device to be discovered is in a different segment from the management server, the device must respond to ICMP ECHO (ping) from the management server.

Devices must have IP addresses assigned

The discovery range must be set correctly

Authentication information must be set correctly

You can set the discovery range and authentication information in the IP Address Range view accessed by clicking Configurations under Discovery in the Settings module.

The prerequisites for a network environment in which devices can be discovered are as follows:

The network supports TCP/IP communication and the firewall settings and other parameters permit communication through chosen ports.

The management server and managed devices are able to communicate with each other via ICMP.

Important

Virtual machines are treated as separate computers for discovery purposes. The guest OS of a virtual machine must be assigned its own IP address and MAC address separate from those assigned to the host OS.

Important

You cannot manage agentless devices in a NAT environment.

Important

By default, computers running Windows Server 2019, Windows Server 2016, Windows 10, Windows 8.1, Windows 8, Windows Server 2012, Windows 7, Windows Server 2008, Windows Vista, Windows Server 2003 (Service Pack 2 or later), or Windows XP (Service Pack 2 or later) cannot use ICMP due to Windows firewall settings. To use ICMP in the discovery process, ICMP must be enabled in the configuration of the computer being discovered.

Important

Do not specify a discovery range that includes a loop-back address or broadcast address. Searches whose discovery range contains such an address might discover devices wrongly.

Tip

You can discover devices that use a wireless LAN, WAN, or VPN, provided that the network environment meets the above prerequisites.

You can automatically distribute the agent program to discovered computers that are running Windows. For details about the conditions that must be met for this to occur, see 2.5.2 Criteria for agent distribution to online-managed computers.

(2) Estimating data traffic during network searches

The following shows general guidelines for estimating how much traffic is generated by a network search.

When using SNMP authentication

If SNMP authentication is successful, approximately 2 KB of data is sent per device.

When using Windows administrative shares

If login to the Windows administrative share is successful, approximately 2.5 MB of data is sent per device. Agent distribution uses approximately 80 MB of data traffic. The data traffic varies depending on the agent configuration.

2.4.3 Linking with Active Directory

By linking with Active Directory, you can retrieve information about devices registered on an Active Directory server, and register those devices with JP1/IT Desktop Management 2. You can also obtain information like user names, telephone numbers, and email addresses that JP1/IT Desktop Management 2 cannot collect automatically.

By acquiring department and location information from Active Directory, you can also synchronize the group relationships of managed devices and asset information with the organizational units (OU) managed by Active Directory.

Device information available from Active Directory

The following table describes some of the features that become available when you link with Active Directory.

Feature

Description

Device registration

This feature lets you discover the computers managed by Active Directory and register them as management targets in JP1/IT Desktop Management 2. You can also update system information based on information provided by Active Directory.

Information retrieval

From the information managed by Active Directory, you can retrieve shared management items relating to device information and hardware asset information, and added management items relating to hardware asset information. Note that Active Directory must be set as the data source for the item.

Retrieval of organizational hierarchy

You can import the hierarchy of organizational units (OU) managed by Active Directory and use it to define the group configuration in JP1/IT Desktop Management 2.

The following table shows the device information you can acquire from Active Directory.

Type of device information

Linkage with Active Directory

Device registration

Information retrieval

Device type

PC (Windows)

Y

Y

Server (Windows)

Y

Y

System information

Computer information

Y

N

OS information

Y

N

Network information

Y

N

Shared management items

Y

Y

Added management items

Y

Y

Legend: Y: Can be acquired. N: Cannot be acquired.

For details about the device information you can acquire from Active Directory, see (3) Device information that can be acquired from Active Directory.

Timing of device information acquisition

If JP1/IT Desktop Management 2 is configured to link with Active Directory, it searches the Active Directory database daily at 23:00 and acquires the relevant device information. You can change the time and frequency of this search by setting a discovery schedule in the Active Directory view under Configurations in the Discovery area of the Settings module.

(1) Searching for devices in Active Directory

You can search for computers managed in Active Directory domains and root OUs and register them as management targets. We recommend that you use this method if your organization already uses Active Directory to manage computers.

The following figure shows an overview of searching Active Directory for devices.

Options for device discovery

You can use the following methods to search for devices registered in Active Directory.

Immediate

JP1/IT Desktop Management 2 connects to Active Directory and searches for devices, acquiring device information for the devices it discovers. Use this option when you first install JP1/IT Desktop Management 2 or when you want changes to Active Directory information to be immediately reflected in the JP1/IT Desktop Management 2 database. You can begin a search from the Active Directory link under Discovery Condition Configuration in the Device Discovery view in the Setting module.

Tip

If you cancel the search before it finishes, any computer information and group information that has been acquired to that point is incorporated into the database.

Scheduled

Regular searches take place according to the discovery settings specified for Active Directory. During this process, device information is acquired for discovered devices. The discovery schedule is determined by the values in Start At, Repeat Interval (daily, weekly, or monthly), and Repeat in the Settings module. By default, discovery takes place daily at 23:00.

Tip

If the search is interrupted or cannot take place at the scheduled time because the service is stopped, the system is shut down, or for some other reason, it will take place at the next scheduled start time.

If the search is interrupted, the process begins again for all computers the next time the service starts. Even if several search attempts have failed, this process takes place only once.

You can check the status of the search in the Last Discovery Log window accessed from the Discovery view in the Settings module. To notify the administrator by email when the process is finished, set a Notice of Discovery Completion in the Discovery view.

Removing managed devices

When you delete a computer from Active Directory, the corresponding information is not deleted from JP1/IT Desktop Management 2. To remove a computer that was discovered from Active Directory, remove it manually from the JP1/IT Desktop Management 2 database.

Discovery conflicts

The discovery of devices registered in Active Directory can sometimes conflict with other forms of discovery.

Conflicts with other Active Directory searches

If Active Directory is already being searched when a search is scheduled to start, the latter process is canceled until the next scheduled start time.

Conflicts with network searches

If a network search is already in progress, the Active Directory search takes place as normal. If both processes discover the same device, the results of network discovery using administrative shares and SNMP take priority over the results of Active Directory discovery, and the results of Active Directory discovery take priority over the results of network discovery using ARP and ICMP.

Related Topics:

(4) Importing departmental group configurations from Active Directory

(2) Setting connection destinations for Active Directory searches

Before you can use Active Directory to search for and discover devices, you need to specify the connection-target Active Directory server and the root OU of the domains you want to search.

You can specify multiple connection targets, each consisting of an Active Directory address and a root OU. Set a number of connection targets equivalent to the number of Active Directory servers and root OUs where you want to discover devices.

The following are examples of setting connection targets for Active Directory searches.

When connecting to one Active Directory server and discovering devices in multiple root OUs

Although the management server only connects to one Active Directory server, it searches for devices in multiple root OUs. This means that you need to create a number of connection destination settings equivalent to the number of root OUs.

When connecting to several Active Directory servers

When searching for devices on several Active Directory servers, you need to create a connection destination setting for each Active Directory server.

Important

When you perform the search for Active Directory, you must grant a user ID (specified in the Active Directory window) the Read permission for all objects that belongs to the specified root OU and for all objects that are referenced. If the user ID is not granted the Read permission, device information and group information may not be correctly obtained when you perform the search for Active Directory.

(3) Device information that can be acquired from Active Directory

The following table lists the device information you can obtain from an Active Directory server.

System information

Device information item

Source

Contents

Object name (LDAP)

Attribute name (LDAP)

Device type

computer

operatingSystem

PC is set for client-type OSs. For server-type OSs, server is set.

Computer information

Computer name

computer

sAMAccountName

Acquires the computer name of the computer.

Host name

computer

dNSHostName

Acquires the DNS name of the computer if one is assigned.

computer

sAMAccountName

Acquires the computer name of the computer if no DNS name is assigned.

OS information

OS

computer

operatingSystem

Acquires the name of the OS.

OS service pack or version

computer

operatingSystemServicePack

Acquires information about the OS service pack or version.

Network information

IP address

--

--

Uses DNS to resolve an IP address from the host name.

MAC address

--

--

Uses ARP to acquire a MAC address from the IP address.

Legend: --: Although this device information can be acquired from Active Directory, it does not appear on the source Active Directory server.

You can also acquire the information in the following table:

Device information item

Description

Registered Date/Time

For a newly discovered device, the date and time when the device was discovered is acquired.

When updating device information, the existing date and time is left unchanged.

Last Modified Date/Time

If the device has been modified, the date and time when the device was modified is acquired.

No date and time is acquired if the device information has not been modified.

Mode

If the Auto-Manage Discovered Nodes option is selected and the device has a product license, Managed is set.

If the Auto-Manage Discovered Nodes option is selected and the device does not have a product license, Discovered is set.

If the Auto-Manage Discovered Nodes option is not selected, Discovered is set.

Management Type

Agentless Management (Authentication Successful) is set.

Connection settings

Unknown is set.

Device Status

Unknown is set.

Management Status

Agent not Installed is set.

Last Alive Confirmation Date/Time

The date and time when the server last connected to the Active Directory and found the device.

Common management items

Shared management items

Source

Contents

Object name (LDAP)

Attribute name (LDAP)

Department

computer

distinguishedName#1

Acquires the department with which the device is associated.

Location

computer

location

Acquires the location of the device.

User Name

User or InetOrgPerson#2

displayname

Acquires the user name of the device.

Account

User or InetOrgPerson#2

userPrincipalName

Acquires the account name of the device.

E-mail

User or InetOrgPerson#2

mail

Acquires the e-mail address of the user of the device.

Phone

User or InetOrgPerson#2

telephoneNumber

Acquires the telephone number of the user of the device.

#1: Organization unit (OU) values in attributes are subjected to conversion before being registered in the common management item. For example, if the attribute value is CN=PC001,OU=2U,OU=Design1G,OU=DesignDivision,DC=domain,DC=local, then DesignDivision/Design1G/2U is registered as the department.

#2: The User or InetOrgPerson object associated with the managedBy attribute of the computer object.

Added management items

You can use the following methods to relate information retrieved from Active Directory to added management items.

Legend: Y: Template provided. N: No template provided.

Item specification

A method that uses supplied templates to specify objects in the Active Directory database.

For example: Name (Computer)

Customized

A process whereby the administrator specifies the object names managed by Active Directory and the LDAP attribute names.

Added management items are acquired as character string data.

The following table shows the objects you can acquire for each entity specified when acquiring information from Active Directory.

Specifiable entity

Associated object

Description

Computer

Computer

Used to manage computer information.

Organizational unit (OU)

Organization Unit (OU)

Contains Computer, User, and other values of Organization Unit. This information is used to record the department and location of a device, and to acquire information about the organizational unit (OU) to which a computer belongs.

User

User

Used to acquire information about the administrator of a computer.

InetOrgPerson#

A type of user. This object is used to acquire information about the administrator of a computer.

#: In Windows 2000, you must apply the InetOrgPerson Kit to use this object.

The following table lists the information that can be acquired from the Computer object.

Item name

LDAP attribute name

Template provided

Name (Computer)

sAMAccountName

Y

DNS Host Name

dNSHostName

Y

Description

description

Y

Name

operatingSystem

N

Version

operatingSystemVersion

N

Service Pack

operatingSystemServicePack

N

Location

location

Y

Name (User)

managedBy

Y

Office Location

--#

N

Country

--#

N

State

--#

N

City

--#

N

Address

--#

N

Phone

--#

N

FAX

--#

N

Canonical name of object

distinguishedName

N

#: Shows the corresponding attribute value for the User or inetOrgPerson object whose value is the same as Name (User). For details on the LDAP attribute names used to acquire this information, see the tables later in this section that show the information that can be acquired from the User and InetOrgPerson objects.

The following table lists the information that can be acquired from an Organization Unit (OU) object.

Property name

LDAP attribute name

Template provided

Country

co

Y

Zip code

postalCode

N

State

st

N

City

l

N

Address

street

N

Description

description

N

Name

managedBy

Y

Link to group policy object

gPLink

N

The following table lists the information that can be acquired from a User object.

Item name

LDAP attribute name

Template provided

Last Name

sn

Y

First Name

givenName

Y

Initials

initials

Y

Display Name

displayName

Y

Description

description

Y

Office Location

physicalDeliveryOfficeName

Y

Phone

telephoneNumber

Y

E-Mail

mail

Y

Web Page

wWWHomePage

Y

Country

co

Y

Zip code

postalCode

Y

State

st

Y

City

l

Y

P. O. Box

postOfficeBox

Y

Address

streetAddress

Y

Logon name

userPrincipalName

Y

Logon name (Windows 2000 or earlier)

sAMAccountName

N

Log on to

userWorkstations

N

User profile profile path

profilePath

N

User profile logon script

scriptPath

N

Home folder Local path

homeDirectory

N

Home folder Connect

homeDrive

N

Home phone

homePhone

Y

Pager

pager

Y

Mobile

mobile

Y

FAX

facsimileTelephoneNumber

Y

IP Phone

ipPhone

Y

Notes

info

Y

Company

company

Y

Department

department

Y

Job title

title

Y

Manager Name

manager

Y

Report Direct

directReports

Y

The following table lists the information that can be acquired from an InetOrgPerson object.

Item name

LDAP attribute name

Template provided

Last Name

sn

Y

First Name

givenName

Y

Initials

initials

Y

Display Name

displayName

Y

Description

description

Y

Office Location

physicalDeliveryOfficeName

Y

Phone

telephoneNumber

Y

Email

mail

Y

Web Page

wWWHomePage

Y

Country

co

Y

Zip code

postalCode

Y

State

st

Y

City

l

Y

P. O. Box

postOfficeBox

Y

Address

streetAddress

Y

Logon name

userPrincipalName

Y

Logon name (Windows 2000 or earlier)

sAMAccountName

N

Log on to

userWorkstations

N

User profile profile path

profilePath

N

User profile logon script

scriptPath

N

Home folder Local path

homeDirectory

N

Home folder Connect

homeDrive

N

Home Phone

homePhone

Y

Pager

pager

Y

Mobile

mobile

Y

FAX

facsimileTelephoneNumber

Y

IP Phone

ipPhone

Y

Notes

info

Y

Company

company

Y

Department

department

Y

Job Title

title

Y

Manager Name

manager

Y

Report Direct

directReports

Y

Important

Although you can specify attributes that acquire information from items not mentioned in these tables, operation is not guaranteed in these circumstances.

For a detailed description of device information, see the following sections:

(1) Types of device information you can collect

(2) Device status information that can be collected

(3) System information that can be collected

(4) Hardware information

(5) Installed software information

(6) Security information

(7) Shared management items for asset information and device information

(4) Importing departmental group configurations from Active Directory

By importing information about the structure of organizational units (OU) from Active Directory, you can synchronize the department hierarchy maintained by JP1/IT Desktop Management 2 with the Active Directory OUs. By actively maintaining the department group configuration managed by Active Directory, you can centrally manage the configuration of managed devices.

JP1/IT Desktop Management 2 imports information about organizational units as part of the search process.

When you specify an organizational unit (root OU) that you want to import from Active Directory, the group configuration for its subordinate OUs is automatically created in the corresponding department group. To import information about department group hierarchies from Active Directory, select Get Department Hierarchy Information in the Active Directory view accessed from the General menu. When this check box is selected, the manager collects department group information when it accesses Active Directory to search for devices. For details on searching Active Directory for devices, see (1) Searching for devices in Active Directory.

The following table shows the effect that importing organizational units (OUs) from Active Directory has on the JP1/IT Desktop Management 2 group configuration.

Active Directory organizational unit (OU)

JP1/IT Desktop Management 2 department group configuration

Present

Not present

Present

If the name is different, the group name is updated accordingly.

The group is added.

Not present

The group is removed.

No action taken.

Note that changing the department group configuration in JP1/IT Desktop Management 2 does not affect the organizational units (OU) registered on the Active Directory server.

Important

After the import process, do not manually add, change, or remove any part of a department group configuration that is synchronized with Active Directory. Any such changes will be overwritten when organizational unit (OU) information is next imported.

If a managed device belongs to a group that is synchronized with an Active Directory OU, the group affiliation of the device changes in line with the Active Directory OU. If the group to which the device belongs is removed, the device is reassigned to the Unknown group.

Tip

If you specify an upper-level domain and its lower-level domain simultaneously in a domain name attribute, the manager imports information for the organizational unit (OU) of the upper-level domain, which includes the information for lower-level domains.

(5) Cautionary notes for Active Directory linkage

Note the following when linking with Active Directory:

You cannot acquire information from an organizational unit (OU) that does not contain at least one computer.

Even if a computer is registered in Active Directory, you cannot acquire device information if the computer is not a JP1/IT Desktop Management 2 management target.

Only character string data can be acquired from Active Directory.

You cannot use certain single-byte symbols and tab characters in the name of an OU in Active Directory.#

#: Do not use the following symbols: !, ", %, ', *, /, : (colon), <, >, ?, @, \, |, +, =, , (comma), or ; (semicolon). The linkage function might not operate correctly if an OU name contains any of these characters.

2.5 Installing the agent

We recommend that you install the agent on computers managed by JP1/IT Desktop Management 2. Installing the agent program allows you to manage a computer efficiently using all the features of JP1/IT Desktop Management 2, which include analyzing the computer's status from the operation window and controlling its operation.

There are two approaches to managing a computer with the agent installed: offline management and online management.

Tip

You can also manage agentless computers. However, some JP1/IT Desktop Management 2 features including automatic application of security measures, message notification, and software and file distribution are unavailable to agentless computers. Agentless management is always used for devices other than computers.

You can use the following methods to install the agent on a computer:

Online management

Installation by an administrator

You can use either of the following methods:

Install the agent automatically on the user's computer by distributing the program from the management server

Have an administrator create an installation set (an installer file that includes the agent program and setup information) and register a logon script on the domain controller

When the user logs on to Windows, the agent is installed automatically on the user's computer.

Installation by a user

The administrator creates an installation set and provides it to the user. The user then installs the agent by executing the installation set.

Offline management

The administrator creates an installation set and uses it to install the agent on the computer

The administrator creates an installation set and registers a logon script on the domain controller

When the user logs on to Windows, the agent is installed automatically on the user's computer.

The administrator uses the supplied media to install and set up the agent on the computer

Tip

Because computers with the agent installed are automatically designated management targets, you must have one product license for each computer.

Tip

You cannot use an installation set or distribution from the management server to install the agent on a computer running the UNIX operating system or Mac OS . For details on how to install the agent on a UNIX computer, see the JP1/IT Desktop Management 2 - Agent Description and User's Guide (For UNIX Systems). For details on how to install an agent on a Mac OS computer, see the instruction manual Agent feature for Mac OS.

2.5.1 Distributing the agent to online-managed computers

You can install the agent on a computer by distributing the agent program from each management server.

There are two ways to distribute the agent:

Automatic distribution to discovered computers

You can automatically distribute the agent program to discovered computers that are running Windows. As each computer is discovered, the agent is distributed to it. Use this approach if you want to install the agent on every computer in your organization.

Manual distribution to agentless computers

You can manually distribute the agent to a management-target computer or discovered computer. Because this approach allows you to select the computers on which to install the agent, it can be used when there are computers in your organization that you want to leave agentless.

For details about the conditions that must be met to distribute the agent, see 2.5.2 Criteria for agent distribution to online-managed computers.

Tip

You cannot install the agent to a computer running the UNIX operating system or Mac OS by distributing the program from the management server. If you select a Windows computer and a UNIX or Mac OS computer and try to distribute the program to those computers, distribution to the UNIX or Mac OS computer fails.

2.5.2 Criteria for agent distribution to online-managed computers

The OS configuration of a distribution-target computer is subject to the same criteria as for when sharing Windows management data in agentless management. For details on these criteria, see 4.2.8 Prerequisites for agentless management.

2.5.3 Assigning agent configurations to online-managed computers

You can control how agents are configured by handling agent configurations on the management server. When you change agent configurations on the management server, the new settings take effect on every online-managed computer to which the particular agent configurations are assigned. This allows you to efficiently change how agents are set up across the system. The agent configurations are only assigned to the agents whose connection target is set to the local server.

By default, each computer is assigned the default agent configuration. However, if an online-managed computer that becomes a new management target is automatically registered in a group with its own agent configurations, the computer is assigned the default agent configuration for that group. For example, if you assign the Windows 7 settings to the Windows 7 Professional OS group, a computer running Windows 7 that becomes a management target is automatically assigned the Windows 7 settings.

You can apply agent configurations at the computer or group level by creating the settings and assigning them to a specific computer or group. You cannot assign agent configurations to a user-defined group.

When you assign agent configurations to an individual computer, the settings take effect on that computer. If you assign agent configurations to a group, the settings take effect on every online-managed computer in that group. The following figure shows how agent configurations are assigned.

If agent configurations are assigned to an individual computer and the group to which it belongs, the agent configurations applied to the computer itself take effect. A group that is not directly assigned agent configurations does not inherit the agent configurations of the upper-level group. The following figure shows which agent configurations apply when a computer is assigned more than one set.

If you cancel agent configurations, the settings assigned to the upper-level group take effect.

In some circumstances, such as when a computer has several network cards, a computer might be registered in more than one group intended for a certain range of IP addresses. If a computer belongs to several groups each with different agent configurations, the default agent configuration apply to that computer.

Tip

You cannot use agent configurations on a computer running UNIX OS or Mac OS. For details on how to set up a UNIX computer, see the JP1/IT Desktop Management 2 - Agent Description and User's Guide (For UNIX Systems) . For details on how to set up a Mac OS computer, see the instruction manual 050502 Agent feature for Mac OS.

Related Topics:

2.18.6 Agent configuration of a managed computer in a multi-server configuration

2.6 Managing devices

All manner of devices including computers, servers, printers, and networking equipment connect to corporate networks. The first step towards gaining a picture of the devices in your organization and managing them from the perspectives of security and asset management is to designate the devices as management targets of JP1/IT Desktop Management 2.

When the devices in your organization are managed by JP1/IT Desktop Management 2, you can use features like the following to efficiently assess the nature of the devices.

Manage devices in lists like a ledger

Automatically collect the latest device information

Keep track of the status of devices using a graphical interface incorporating panels and reports

A maximum of 300,000 devices can be managed. If you manage 50,000 devices or more, enable the large-scale management option when installing JP1/IT Desktop Management 2 - Manager.

You can make a device a management target by:

Installing the agent on a computer

A computer with the agent installed automatically becomes a management target with it connects to the management server. If you use JP1/IT Desktop Management 2 to manage the devices in your organization, we recommend that you install the agent on all computers.

Designating a discovered device as a management target

You can use the search feature to discover devices that are connected to the network or managed by Active Directory. You can configure the system to automatically designate discovered devices as management targets, or define management targets manually by selecting the devices you want to manage from a list. Use this method to manage devices other than computers.

Tip

The discovery process helps you gain a clear picture of the devices in your organization.

Acquiring information about smart devices by linking with an MDM system

By using the MDM linkage feature, you can acquire smart device information from an MDM system and use it to discover smart devices. You can configure the system to automatically designate discovered devices as management targets, or define management targets manually by selecting the smart devices you want to manage from a list.

Designating devices reported by an external system via the API as management targets

You can designate devices as management targets by using the API provided by JP1/IT Desktop Management 2. The use of the API allows you to incorporate the devices discovered or managed by an external system into JP1/IT Desktop Management 2 or register latest device information in JP1/IT Desktop Management 2.

You need one license for each device you designate as a management target. Make sure that you have enough licenses for the number of devices you will be managing.

Related Topics:

2.6.1 Designating discovered devices as management targets

3.1 Overview of product licenses

2.6.1 Designating discovered devices as management targets

While computers with the agent installed are automatically designated as management targets, other devices must be made management targets by a manual process.

Tip

In the discovery settings, you can choose to configure the system to automatically designate discovered computers as management targets.

Tip

The search function cannot be used to find undetected devices that are powered off, even if they are connected to the network.

You can designate a discovered device as a management target or exclusion target by changing the management status. To manage a device in JP1/IT Desktop Management 2, designate it as a management target. Devices that you do not need to manage in JP1/IT Desktop Management 2 can be designated as exclusion targets.

You need one license for each device you designate as a management target. Making a managed device an exclusion target decreases the number of used licenses by one.

In a multi-server configuration, the management status of a device can be changed only for devices detected by the local server. If the management status of a device is changed, the device information is reported to the higher management server, and then the management status is updated, regardless of whether a license is available.

The following figure shows the relationships between the transition of the management status of a device and the number of used licenses.

Discovered

The device has been discovered by a discovery process. A device in this state does not use a license. You can choose whether to manage a discovered device in JP1/IT Desktop Management 2 by designating it as a management target or exclusion target.

If the system is configured to automatically designate discovered devices as management targets, a device enters this status when there are no more licenses available.

Management target

The device is to be managed by JP1/IT Desktop Management 2. Each management target device uses one license. When you have registered a device as a management target, you can use the features of JP1/IT Desktop Management 2 to manage the device.

You can designate a managed device as an exclusion target or remove the device as a management target if needed.

Exclusion target

The device is excluded as a management target of JP1/IT Desktop Management 2. A device in this state does not use a license. For example, if you only want to manage computers in JP1/IT Desktop Management 2, you can designate other devices like printers and networking equipment as exclusion targets.

Tip

If a device does not require management, you can designate it as an exclusion target. The agent program is no longer distributed to the exclusion target device. This prevents it from appearing in the results of future discovery processes, limiting the results to new devices.

You can designate an excluded device as a management target or remove the device as a management target if needed.

Deleted

Device information has been removed from JP1/IT Desktop Management 2. When you delete a device, information about the device is removed from the database.

Deleted devices can be discovered again. When this occurs, the device is treated as a new device and previous settings are not retained.

Related Topics:

(1) Types of device information you can collect

(2) Device status information that can be collected

(3) System information that can be collected

(4) Hardware information

(5) Installed software information

(6) Security information

(7) Shared management items for asset information and device information

(1) Devices supported as management targets

JP1/IT Desktop Management 2 can manage any device that is connected to a network and has an IP address. The following table lists the types of devices that can be management targets.

Device types

Management method

Agent

Agentless

Active Directory linkage

MDM system linkage

External system with API linkage

PC or server (including virtualized environments)

Windows

Y

Y

Y

A#1

Y

UNIX

Y

Y

N

N

Y

Linux

Y

Y

N

N

Y

Mac OS

Y

Y

N

N

Y

Chrome OS

N

N

N

A#2

N

Smart device

N

N

N

Y

Y

Other device

N

Y

N

N

Y

Legend: Y: Can be managed. N: Cannot be managed. A: Can be managed conditionally.

#1: Can be managed only when MDM System to be linked is Microsoft Intune and the obtained Device type is PC.

#2: Can be managed only when MDM System to be linked is Google Workspace.

A device that has an IPv4 and an IPv6 address can be managed using its IPv4 address.

You can manage a device with only an IPv6 address by discovering the device in Active Directory. In this case, you can keep track of the device presence but not any other information.

Related Topics:

(1) Types of device information you can collect

(2) Device status information that can be collected

(3) System information that can be collected

(4) Hardware information

(5) Installed software information

(6) Security information

(7) Shared management items for asset information and device information

2.4.2 Discovering networked devices

(2) Managing virtual computers

You can manage the virtual computers in your system as separate devices, provided they have an operating system installed. This allows you to collect device information for virtual computers and manage their security status.

To be recognized as a computer independently from its host virtualization server, a virtual computer must meet one of the following criteria:

The virtual computer has a different MAC address from the virtualization server

If the virtual computer shares its MAC address with the virtualization server, an agent is installed on the virtualization server and on the virtual computer

Installing the agent on a virtual computer allows it to be recognized as a separate entity from its host, even when they share a MAC address.

When using hardware-based virtualization

When a virtualization server manages virtual computers using a hypervisor that works directly on the hardware, you can manage each virtual computer as a separate computer. However, because there is no OS on the virtualization server, the server itself is not recognized as a standalone computer and cannot be managed.

When using software-based virtualization

When a virtualization server manages virtual computers using virtualization software running on an operating system, because the virtual computers and the virtualization server each have operating systems installed, they can be managed as separate computers.

The following figure shows how JP1/IT Desktop Management 2 handles virtualization servers and virtual computers.

Managing shared VDI-based virtual computers

You can also manage shared VDI-based virtual computers. A shared VDI-based virtual computer refers to a copy of the image of the master virtual computer, which is created for each user. JP1/IT Desktop Management 2 can manage a copy of the virtual computer as an actual computer.

Important

The agentless management of shared VDI-based virtual computers is not allowed.

Note that even when shared VDI-based virtual computers become the agentless management targets as a result of automatic registration performed during a search, one license is used for each registered virtual computer.

Shared VDI-based virtual computers support only Windows agents. Shared VDI-based virtual computers do not support UNIX agents.

Shared VDI-based virtual computers do not support a relay system or a management relay server.

2.6.2 Collecting device information

JP1/IT Desktop Management 2 collects device information from the devices it manages. It can also collect device information from Active Directory, or information can be entered directly by an administrator. You can view device information in the Inventory module.

For details about the types of device information JP1/IT Desktop Management 2 can collect, see (1) Types of device information you can collect.

Note that the range of information you can collect depends on the type of device, as described next.

Computers with the agent installed

The manager collects every piece of device information managed by JP1/IT Desktop Management 2. It can also collect the information managed by Active Directory. Administrators can also enter certain information directly.

You can also display a form to users and collect the information they enter. For details about how to collect information entered by users, see (12) Collecting user information.

You can also search for and collect information about software that does not appear in the Programs and Features list of the Windows Control Panel. For details, see (11) Defining search conditions for software information.

Important

Do not manage Windows devices simultaneously in the following ways:

Managing device information with agent Installed.

Managing device information Imported from Microsoft Intune.

Agentless computers

Device information is collected during the discovery process, to the extent permitted by the authentication settings. Authentication can use Windows administrative shares or SNMP. If authentication fails, the manager acquires device information within the scope available to the ICMP or ARP protocol.

You can also collect the information managed by Active Directory, and administrators can enter certain information directly.

Important

Even in a setting that obtain device information using Microsoft Intune with MDM linkage, when network search is executed with SNMP authentication, the data collected via SNMP authentication is preferentially imported into JP1/IT Desktop Management 2. If you want to import the data retrieved from Microsoft Intune to JP1/IT Desktop Management 2, set search area of the network search so that the devices are not network search.

Devices other than computers

The manager acquires the range of device available via SNMP authentication or the ICMP or ARP protocol.

Administrators can also enter certain information directly.

Timing of device information collection

The following describes how the timing with which information is collected depends on the device type.

Computers with the agent installed

Online-managed computers

JP1/IT Desktop Management 2 automatically collects device information when a computer becomes a management target, and updates the database when changes are detected in the information associated with a computer.

Offline-managed computers

Device information is updated each time you use external media to provide the computer's information to the management server.

In the case of agents for UNIX or Mac, note that you cannot collect device information from offline-managed computers.

Agentless computers and devices other than computers

Device information is updated regularly according to a set schedule.

You can collect the latest device information from devices with the agent installed at any time you wish.

When collecting device information in this way, the management server collects the most recent information entered by the user.

(1) Types of device information you can collect

JP1/IT Desktop Management 2 collects device information from the devices it manages. There are two categories of device information: Basic device information, and common fields (assets and device inventory).

Basic device information

Device information that is collected by default. There are four categories of basic device information: System Details, Hardware Details, Installed Software Details, and Security Details.

Common fields (Assets and device inventory)

Information that relates to the user of a device. You can have users enter this information directly.

The range of device information you can collect depends on whether the device is a computer with the agent installed. For agentless devices, the information you can collect depends on the authentication method used. The explanation below refers to the following types of authentication used with agentless devices:

Administrative share: You can use the authentication provided by a Windows administrative share.

SNMP: You can use the authentication implemented by SNMP.

ARP: You can use the authentication implemented by ARP.

ICMP: You can use the authentication implemented by ICMP.

Active Directory: JP1/IT Desktop Management 2 links with Active Directory.

MDM: JP1/IT Desktop Management 2 links with an MDM system.

API: JP1/IT Desktop Management 2 links with an external system via the API.

If a device cannot undergo authentication using Windows administrative shares or SNMP, you can use ICMP or APR to verify the device presence but not to collect information from the device. When linking with Active Directory, some items can be collected from Active Directory while others cannot.

When linking with an MDM system to manage smart devices, you can collect the information managed by the MDM system as device information.

The use of the API from an external system allows you to collect the information managed by the external system as device information.

You can view collected device information in the Device Inventory and Software Inventory views of the Inventory module. Reasons why the system might be unable to collect device information include the device being turned off or not connected to the network, or failing to establish a connection with the management server. Items for which --, N/A, or Unknown is displayed could not be collected. Reasons why a particular item cannot be collected include the device's authentication status, device type, operating system, and software.SNMP: NG(No credential) might appear if not enough information was collected to identify a device.

The tables in the next section show the items of device information you can collect, and whether each item can be collected from a computer with the agent installed, an agentless device, Active Directory, an MDM system, or API.

(2) Device status information that can be collected

The following table lists the information JP1/IT Desktop Management 2can collect about the status of a device.

When using SNMP authentication, the device information that can be collected depends on the SNMP agent installed on the computer. This means that some device information might not be collected.

Management Type

Icon

Description

Agent installed

Agentless

Windows

UNIX or Mac OS

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

Agent Management

Indicates a device with the agent installed.

Y

Y

--

--

--

--

--

--

Agentless Management (Authentication Successful)

Indicates a device that has undergone successful authentication via a Windows administrative share or via SNMP. Also indicates a device that is newly discovered by Active Directory discovery.

--

--

Y

Y

--

Y

--

--

Agentless Management (Authentication Failed)

Indicates a device that has not undergone authentication.

--

--

--

--

Y

--

--

--

Agent Management (Network Access Control)

Indicates a device with the agent installed and with network access control enabled.

Y

--

--

--

--

--

--

--

Agent Management (Network Access Control)(Starting management)

Indicates a device with the agent installed and network access control in the process of starting.

Y

--

--

--

--

--

--

--

Agent Management (Network Access Control)(Failed to start management)

Indicates a device with the agent installed, where an attempt to start network access control has failed.

Y

--

--

--

--

--

--

--

Agent Management (Network Access Control)(Stopping management)

A device with the agent installed and network access control disabled.

Y

--

--

--

--

--

--

--

Agent Management (Network Access Control)(Failed to stop management)

A device with the agent installed where an attempt to stop network access control has failed.

Y

--

--

--

--

--

--

--

Agent Management (Relay system)

Indicates a device with a relay system installed.

Y

--

--

--

--

--

--

--

Agent Management (Relay system)(Network Access Control)

Indicates a device with a relay system installed and with network access control enabled.

Y

--

--

--

--

--

--

--

Agent Management (Relay system)(Network Access Control - Starting management)

Indicates a device with a relay system installed and network access control in the process of starting.

Y

--

--

--

--

--

--

--

Agent Management (Relay system)(Network Access Control - Failed to start management)

Indicates a device with a relay system installed, where an attempt to start network access control has failed.

Y

--

--

--

--

--

--

--

Agent Management (Relay system)(Network Access Control - Stopping management)

Indicates a device with a relay system installed and network access control disabled.

Y

--

--

--

--

--

--

--

Agent Management (Relay system)(Network Access Control - Failed to stop management)

Indicates a device with a relay system installed, where an attempt to stop network access control has failed.

Y

--

--

--

--

--

--

--

Management Relay Server

Indicates a management relay server installed.

Y#

--

--

--

--

--

--

--

Management Relay Server (Network Access Control)

Indicates a management relay server installed and network access control enabled.

Y#

--

--

--

--

--

--

--

Management Relay Server (Network Access Control - Starting management)

Indicates a management relay server installed and network access control in the process of starting.

Y#

--

--

--

--

--

--

--

Management Relay Server (Network Access Control - Failed to start management)

Indicates a management relay server installed, where an attempt to start network access control has failed.

Y#

--

--

--

--

--

--

--

Management Relay Server (Network Access Control - Stopping management)

Indicates a management relay server installed and network access control disabled.

Y#

--

--

--

--

--

--

--

Management Relay Server (Network Access Control - Failed to stop management)

Indicates a management relay server installed, where an attempt to stop network access control has failed.

Y#

--

--

--

--

--

--

--

MDM Linkage Management

Indicates a device has acquired information from an MDM system and managing the information.

--

--

--

--

--

--

Y

--

API Management

Indicates a device has acquired information from an external system via the API and managing the information.

--

--

--

--

--

--

--

Y

Legend: Y: Can be collected. --: Not applicable.

#: Refers to the agent for the management relay server.

Connection settings

Connection settings indicate the network connection settings status in JP1/IT Desktop Management 2.

Icon

Description

Agent installed

Agentless

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

Allowed

The device is able to connect to the network.

Y

Y

Y

Y

Y

Y

Y

Blocked

The device is unable to connect to the network. This status also applies to devices whose network connection was automatically blocked by a security policy or the network monitoring function.

Y

Y

Y

Y

Y

Y

Y

Forced Block

A device whose network connection has been blocked by an administrator.

Y

Y

Y

Y

Y

Y

Y

Not use period

A device that is not allowed to connect to the network because it is outside the allowed time period defined in the network control list.

Y

Y

Y

Y

Y

Y

Y

Unknown

JP1/IT Desktop Management 2is determining whether the device is permitted to connect to the network. The device will transition to another status when the judgment is made.

Y

Y

Y

Y

Y

Y

Y

Legend: Y: Can be collected.

Device Status

Icon

Description

Agent installed#1

Agentless

Windows

UNIX or Mac OS

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

Running

Indicates that the computer is on.

Y

N

Y

Y

Y

N

N

Y

Stop

Indicates that the computer is off.#2

Y#3

N

Y

Y

Y

N

N

Y

Warning

There is a problem with the device. You can use the System Information and Events tabs of the Inventory module to investigate further.

Y#3, #4

N

N

Y#5

N

N

N

Y

Critical

There is a serious problem with the device. You can use the System Information and Events tabs of the Inventory module to investigate further.

N

N

N

Y#6

N

N

N

Y

Unknown

The status of the device is unknown.

N

Y

N

Y

Y

Y

Y

Y

Management by Management Server Under the Local Server

Indicates that the managing device of the device is a management relay server under the local server. The operation status is not collected for this device.

Y

Y

Y

Y

Y

Y

Y

Y

Legend: Y: Can be collected. N: Cannot be collected. --: Not applicable.

Note:

For details about the conditions under which each device status is displayed, see (8) Criteria for device statuses.

#1

Stop appears as the device status when you first acquire the status of an offline-managed computer. Each time thereafter, the device retains its previous status.

However, if ON is specified for the OfflineRegistration_StatusUnknown property in the configuration file (jdn_manager_config.conf), the device status will be Unknown.

#2

If a device cannot be communicated with, the device status becomes Stop.

#3

The following devices' statuses become Warning when they are turned off and being managed offline. The status for such devices never appears as Stop.

Relay system

Computer with the agent installed and network access control enabled

#4

The device status for an agent-installed computer on which network monitoring is enabled becomes Warning when JP1_ITDM2_Network Monitor service is stopped.

#5

The device status for a printer whose toner or paper level is low becomes Warning.

#6

The device status for a printer that has no remaining toner or paper becomes Critical.

Management Status

Icon

Description

Agent installed

Agentless

Windows

UNIX or Mac OS

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

Online management

The device is being managed online.

Y

Y

--

--

--

--

--

--

Offline management

The device is being managed offline.

Y

--

--

--

--

--

--

--

Agent not Installed

The agent is not installed on the device.

Y

--

Y

Y

Y

Y

Y

Y

Legend: Y: Can be collected --: Not applicable

Information of the management relay server to which the managed device connects

Item

Description

Agent installed

Agentless

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

Managing Source

Indicates the host name of the management relay server that manages the device. If the device is managed by the local server, (local server) is displayed.

Y

Y

Y

Y

Y

Y

Y

Route to the Managing Source

Indicates the route from the local server to the management relay server that manages the device.

Y

Y

Y

Y

Y

Y

Y

Legend: Y: Can be collected.

(3) System information that can be collected

This section describes the information that JP1/IT Desktop Management 2 can collect as system information. System information consists of the following:

Device type

Host ID

Computer information

User information

OS information

Network information

Printer information

Smart device information

Microsoft Intune information

When using SNMP authentication, the device information that can be collected depends on the SNMP agent installed on the computer. This means that some device information might not be collected.

Device type

Device type

Description

Agent installed

Agentless

Windows

UNIX or Mac OS

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

PC

Set when the OS type is one of the following:

Windows 11#3, #4

Windows 10#3, #4

Windows 8.1

Windows 8

Windows 7

Windows Vista

Windows XP

Windows 2000

Windows OS (unknown edition)

Windows OS (unknown type)

Mac OS

Chrome OS#6

Unknown OS

Y

Y#1

Y

Y

N

Y

A#5, #7

Y

Server

Set when the OS type is one of the following:

Windows 2000 Server

Windows 2000 Advanced Server

Windows Server 2003

Windows Server 2008

Windows Server 2012

Windows Server 2016

Windows Server 2019

Windows Server 2022

UNIX

AIX

HP-UX

Solaris

Linux

CentOS

Red Hat Enterprise Linux

Oracle Linux

Y

Y

Y

Y

N

Y

N

Y

Storage

Must be assigned to a device by an administrator.

N

N

N

N

N

N

N

Y

Network Device

Collected automatically for a network device other than a network printer.

N

N

N

Y

N

N

N

Y

Printer

Collected automatically for a network printer.

N

N

N

Y

N

N

N

Y

Smart Device

Set when the information was acquired from an MDM system.

N

N

N

N

N

N

Y

Y

Peripheral Device

Must be assigned to a device by an administrator.

N

N

N

N

N

N

N

Y

USB Device

Set in the following cases:

When input by an administrator

When registered from the Register USB Device dialog box

N

N

N

N

N

N

N

Y

Display

Must be assigned to a device by an administrator.

N

N

N

N

N

N

N

Y

Other

Must be assigned to a device by an administrator.

N

N

N

N

N

N

N

Y

Custom device type#2

Must be assigned to a device by an administrator.

N

N

N

N

N

N

N

Y

Unknown

Set when the device type could not be acquired.

N

N

N

N

Y

N

N

Y

Legend: Y: Can be collected automatically. N: Cannot be collected automatically. A: Can be collected conditionally.

#1: An agent can be installed in the following Mac OSs: OS X 10.10, OS X 10.11, macOS 10.12, macOS 10.13, macOS 10.14, macOS 10.15, macOS 11, macOS 12, macOS 13, macOS 14 and macOS 15.

#2: In a multi-server configuration, when a device type is changed on a management relay server, and if the new device type item is not set in the higher management server, the item is added to the higher management server. If the maximum number of items that can be added on the higher management server is exceeded, the device information update fails on the higher management server. Check events of the higher management server to see whether the update failed.

#3: For Windows 10 Enterprise multi-session and Windows 11 Enterprise multi-session, the Device Type is Server.

Tip

Special network devices that are Linux-based such as BIG-IP might be discovered as servers (Linux). After checking the Device Details of the discovered device, you can change the device type if needed.

Tip

A printer that has the functionality of a router may be discovered as a Network Device. In this case, check the device information of the discovered device, and modify device type if necessary.

#4: You can collect it when Microsoft Intune is used as MDM system.

#5: If Microsoft Intune is used as MDM System and the obtained OS type is Windows, the device classification is always "PC". For all other OS, you cannot collect it.

#6: You can collect it when Google Workspace is used as MDM system.

#7: If Google Workspace is used as MDM System and the obtained OS type is ChromeOS or ChromeOS Flex, the device classification is always "PC". For all other OS, you cannot collect it.

Host ID

Item

Description

Agent installed

Agentless

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

Host ID

Displays the host ID.

Y

Y

Y

Y

Y

Y

Y

Legend: Y: Can be collected

Note: A host ID of an agent-installed computer or a computer from which information is collected through administrative share identifies the device based on the items listed below. When any of the information items are changed due to a hardware component replacement, the computer can be registered as a different device.

Machine UUID

Machine serial number

BIOS serial number

Motherboard serial number

Note that a computer is registered as a different device up to three times when any of the information items listed above are changed.

Note

When you manage shared VDI-based virtual computers, you can generate host IDs based on one of the following device information items:

Computer name#1

Account name#2

IP address (IPv4)#1

#1: This option is selectable when VMware Horizon View and the Machine Creation Services (MCS) technology provided by Citrix Virtual Desktops are used.

#2: This option is selectable when the Provisioning Services (PVS) technology provided Citrix Virtual Desktops is used.

Furthermore, when the device information item in question satisfies all of the following conditions, it is used as part of the host ID to be generated:

Computer name

A string that does not exceed 15 characters and consists of alphanumeric characters, a hyphen (-), and a underscore (_)

Account name

A string that does not exceed 20 characters and consists of alphanumeric characters, spaces, and symbols (-, !, #, $, ', (, ), ., ^, _, `, {, }, and ~)

Important

Observe the following precautions concerning the generation of host IDs for the management of shared VDI-based virtual computers:

The device information item to be used for the generation of a host ID must be unique.

The device information item to be used for the generation of a host ID must be appropriate to each virtualization method. If you select an incorrect device information item, licenses might not be counted correctly.

If you use an IP address to generate a host ID, assume that only one IP address is set for each virtual computer. When multiple IP addresses are set for a virtual computer, only one of them is used to generate a host ID.

When you validate the setting to obtain an IP address automatically on Windows, use the device information item other than IP address to generate a host ID.

Note

If a device with the OS type "Chrome OS" is acquired in JP1/IT Desktop Management 2 once in conjunction with Google Workspace, initialized and re-registered with Google Workspace, JP1/IT Desktop Management 2 will treat it as the same device.

Computer information

Item

Description

Agent installed

Agentless

Windows

UNIX

Mac OS

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

AIX

HP-UX

Solaris

Linux

Computer information

Computer Name (Description)

Name (Computer)

The computer name set in the Computer Name Changes dialog box displayed by clicking Change on the Computer Name panel of the System Properties.

For SNMP authentication, the acquired host name is displayed.

For a smart device, the name is one of the following names used to identify the smart device in the MDM system: the smart device name, or a name that is the combination of the user name, contract phone number, and model name, separated with colons (:).#1

Description (Computer)

The value in the Computer description field on the Computer Name panel of the System Properties.

For SNMP authentication, the description about the device and the object ID unique to the device developer are displayed.

For smart devices, this information cannot be acquired.

Y

Y#2

Y#2

Y#2

Y#2

Y#2

Y

Y

N

Y

Y

Y

Host Name

The fully qualified domain name of the physical host.

In the following circumstances, the NetBIOS name or the host name without a domain name are collected.

The host is not part of a domain or its domain membership cannot be confirmed

The host name was acquired by an SNMP search

For a smart device, the smart device name, or a combined name of the user name, contract phone number, and model name, connected with colons (:), that are displayed to identify the smart device in the MDM system.#1

Y

Y#2

Y#2

Y#2

Y#2

Y#2

Y

Y

N

Y

Y

Y

Model (Manufacturer)

The model and manufacturer of the computer, assigned by the vendor.

Y

Y#11

Y#11

N

Y

Y

Y

N

N

N

Y

Y

UUID

The universally unique identifier (UUID) of the computer.

Y

N

N

N

Y

Y

Y

N

N

N

A#12

Y

Serial #

The serial number (BIOS information) of the computer.

Y

Y

Y

N

Y

Y

Y

N

N

N

Y

Y

CPU

The model name of the CPU.

Y

Y

Y

Y

Y

Y

Y

Y

N

N

A#12

Y

Total Memory

The total amount of physical memory installed in the computer.

Y

Y

Y

Y

Y

Y

Y

Y

N

N

Y

Y

Total Free Space

The amount of free space on the hard disk (the type of logical drive is Local Disk).

If the total amount of free space on the local disk exceeds 9,223,372,036,854,775,807 bytes, 9,223,372,036,854,775,807 (bytes) is displayed.

Y

Y

Y

Y

Y

Y

Y

N

N

N

N

Y

System Drive

System Drive

The total number of logical drives.

Y

Y

N

N

Y

Y

Y

N

N

N

N

Y

System Drives#3 (Type/Free/Total/File System)

If there are several system drives, the following information can be collected for each drive:

Type

The type of drive, such as hard disk, CD/DVD drive, or removable disk.

Free space#4

The free space available on the drive.

Capacity#4

The total capacity of the drive.

File system#4

The name of the file system, such as FAT32 or NTFS.

The string Locked by BitLocker appears when the system drive is locked by BitLocker.

Y

Y

Y

Y

Y

Y

Y

N

N

N

A#12

Y

Disk Name (Capacity/Interface)#5

Disk Name

The model of the hard disk drive.

Total Capacity

The total capacity of the hard disk drive.

Interface

The interface such as IDE or SCSI used with the hard drive.

Y

Y

Y

Y

Y

Y

Y

Y#6

N

N

Y#7

Y

BIOS Information

BIOS Information

The name of the BIOS.

Y

N

N

N

N

N

Y

N

N

N

N

Y

Manufacturer

The manufacturer of the BIOS.

Y

N

N

N

Y

N

Y

N

N

N

N

Y

Serial Number

The serial number of the BIOS.

Y

N

N

N

N

N

Y

N

N

N

A#10

Y

Version (BIOS/SMBIOS)

BIOS

The version of the BIOS.

SMBIOS

The version of the SMBIOS.

Y

N

N

N

Y

N

Y

N

N

N

N

Y

Release Date

The release date of the BIOS.

Y

N

N

N

Y

N

Y

N

N

N

N

Y

AMT Firmware Version

The version of the AMT firmware.

Y

N

N

N

N

N

N

N

N

N

N

Y

Power Control

Turn off monitor (AC/DC)#8, #9

The length of time until the monitored power supply shuts off.

AC

Indicates an AC power supply.

DC

Indicates a DC (battery) power supply.

Y

N

N

N

N

N

Y

N

N

N

N

Y

System standby (AC/DC)#8

The length of time until the system enters standby.

AC

Indicates an AC power supply.

DC

Indicates a DC (battery) power supply.

Y

N

N

N

N

N

Y

N

N

N

N

Y

System hibernates (AC/DC)#8

The length of time until the system goes into hibernation.

AC

Indicates an AC power supply.

DC

Indicates a DC (battery) power supply.

Y

N

N

N

N

N

Y

N

N

N

N

Y

Turn off hard disks (AC/DC)#7, #8

The length of time before the hard disk is turned off.

AC

Indicates an AC power supply.

DC

Indicates a DC (battery) power supply.

Y

N

N

N

N

N

Y

N

N

N

N

Y

Processor Throttle (AC/DC)#8, #9

The power setting of the processor.

AC

Indicates an AC power supply.

DC

Indicates a DC (battery) power supply.

Y

N

N

N

N

N

Y

N

N

N

N

Y

Legend: Y: Can be collected. N: Cannot be collected. A: Can be collected conditionally.

#1: For whether the smart device name or the combined name of the user, contract phone number, and model name connected with colons (:) is displayed, see the descriptions about the computer name and host name in (2) Device information that can be acquired from MDM systems.

#2: The information is collected if the agent for UNIX or Mac is set so that the computer name is notified. In this case, the host name (fully qualified domain name) is collected as if it is a computer name. Note that computer description cannot be obtained.

#3: For a Windows agent, a drive letter (such as C: and D:) is obtained, For an agent for UNIX or Mac, a mount path is obtained,

#4: In Windows Server 2019, Windows Server 2016, Windows 10, Windows 8.1, Windows 8, Windows Server 2012, Windows 7, and Windows Server 2008 R2, information cannot be collected if BitLocker drive encryption is locked.

#5: In Windows Server 2019, Windows Server 2016 and Windows Server 2012, if a virtual disk is configured with the storage service, the virtual disk information is collected as a physical disk.

#6: Only Disk Name and Capacity can be collected.

#7: Only Capacity can be collected.

#8: If a user without Administrator permission is logged on to a computer running Windows Server 2003 or Windows XP, the system collects the power control settings for the last user who logged on with Administrator permission.

#9: If these features cannot be used, correct information might not have been collectable.

#10: You can collect it only when the Microsoft Intune is used as MDM system and the obtained device classification is "PC". And you can also collect it only when Google Workspace is used as MDM System and the OS type is "Chrome OS".

#11: Only Model can be collected.

#12: You can collect it only when Google Workspace is used as MDM System and the OS type is "Chrome OS".

User Details

Item

Description

Agent installed

Agentless

Windows

UNIX

Mac OS

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

Last Logged On User Name (User Name)

The user name or account name and domain name (or computer name) of the last user to log on.

Y#1

N

Y

Y#1

N

N

N

A#3

Y

Last Logged On User Description

A description of the last user to log on.

Y#1

N

N

Y#1

N

N

N

N

Y

Locale/Current Time Zone

Locale

The locale of the last user to log on.

Current Time Zone

The time zone of the last user to log on.

Y

N

Y#2

Y

N

N

N

N

Y

Legend: Y: Can be collected. N: Cannot be collected. A: Can be collected conditionally.

Note: The user details can be collected when the user logs on by using the console. The user details cannot be collected when the user logs on remotely.

#1: If the last user to log in is a domain user, you cannot collect the full name and description of the user.

#2: Only information about the time zone can be collected.

#3: You can collect it only when Google Workspace is used as MDM System and the OS type is "Chrome OS".

OS Details

Item

Description

Agent installed

Agentless

Windows

UNIX

Mac OS

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

AIX

HP-UX

Solaris

Linux

OS and Service Pack or Version (Language) #1

The service pack or version, and the language of the OS that are applied to the OS. This information indicates which language version of Windows (such as English or Japanese) is installed, not the locale setting.

Y

Y#2

Y#2

Y#2

Y#2

Y#2

Y

N

N

Y#3

Y#4

Y

Kernel version

The kernel version of Linux.

N

N

N

N

Y

N

N

N

N

N

N

Y

Serial #

The serial number of the OS. The serial number is different from the license key needed to install the OS.

Y

N

N

N

N

N

Y

N

N

N

N

Y

Owner (Company)

Owner

The owner name entered by the user when installing the OS.

Company

The company name entered by the user when installing the OS.

Y

N

N

N

N

N

Y

N

N

N

N

Y

OS last startup date/time

The last startup date and time of the OS.

Y

Y

Y

Y

Y

Y

Y

N

N

N

N

Y

Windows directory

The directory in which the OS is installed.

Y

N

N

N

N

N

Y

N

N

N

N

Y

Windows Installer Version

The version number of Windows Installer.

Y

N

N

N

N

N

Y

N

N

N

N

Y

Windows Update (Agent Version)

The version number of the Windows Update agent.

Y

N

N

N

N

N

Y

N

N

N

N

Y

IE Version (Service Pack)

IE Version

The Internet Explorer version.

IE Service Pack

The service pack version of Internet Explorer.

Y

N

N

N

N

N

Y

N

N

N

N

Y

Legend: Y: Can be collected. N: Cannot be collected.

#1: Information to be collected depends on the operating system of the agent.

For any operating system other than Windows 10, Windows Server 2019, or Windows Server 2016:

The service pack information of the operating system is collected.

For Windows 10, Windows Server 2019, or Windows Server 2016:

The version information that is returned by the Ver.exe command of the operating system (for example, 1511) is collected.

#2: Only the OS name can be collected.

#3: Only information about the OS service pack or version can be collected.

#4: Only the OS name and the version information can be collected.

Network Details

Item

Description

Agent installed#1

Agentless

Windows

UNIX or Mac OS

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

IP Address/Subnet Mask#6

The IP address and subnet mask of the device.

Y

Y

Y

Y

Y#2, #3

Y

A#9

Y

Network Adapter

The name of the network adapter.

Y

Y

Y

Y

N

N

Y#8

Y

MAC Address#6

The MAC address of the device.

Y

Y

Y

Y

Y#3, #4

Y

Y

Y

Default Gateway

The default gateway.

Y

Y

Y

Y

N

N

N

Y

WINS Server Address (Primary/Secondary)

Primary

The address of the primary WINS server.

Secondary

The address of the secondary WINS server.

Y

N

Y

N

N

N

N

Y

DNS Server Address

The address of the DNS server.

Y

Y#7

Y

N

N

N

N

Y

DHCP

Whether or not DHCP is enabled.

Y

Y

Y

N

N

N

N

Y

DHCP Server Address

The address of the DHCP server.

Y

Y

Y

N

N

N

N

Y

Lease Acquisition/Expiration Date/Time

The date and time when the DHCP lease was acquired, and then date and time when the lease expires.

Y

N

Y

N

N

N

N

Y

Domain (Workgroup)/Role

Domain

The name of the domain or workgroup to which the computer belongs.

Domain Role

The role of the device in the OS domain, such as primary domain controller or member workstation.

Y

N

Y

Y#5

N

N

N

Y

Legend: Y: Can be collected. N: Cannot be collected. A: Can be collected conditionally.

Note: The network information can be collected only from network adapters that appear in the Control Panel.

#1: Cannot be collected from an offline-managed computer lacking a NIC.

#2: Only the IP address can be collected.

#3: The collected information does not appear on the System Details tab of the Device Inventory view of the Inventory module. You can review the collected information by exporting the device list.

#4: Only collected in environments that use ARP.

#5: Only the Domain is collected.

#6: The System Details tab of the Device Inventory view of the Inventory module displays all device information (information regarding the devices connected to the network) held by the computer. The Device List view and the system configuration information display information regarding the network-connected devices used for communication with a higher system. However, when the computer is communicating with the Internet gateway, information regarding one of the network-connected devices held by the computer is displayed.

#7: Up to 2 addresses can be collected.

#8: When Microsoft Intune is used as MDM system and the obtained device classification is "PC", either "Wi-Fi" or "Ethernet" is displayed on the network adapter.

#9: You can collect it only when Google Workspace is used as MDM System and the OS type is "Chrome OS". And, only IP Address can be collected.

Printer Details

Item

Description

Agent installed

Agentless

Windows

UNIX or Mac OS

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

Printing Method (Method/Colors)

The printing method used by the printer.

N

N

N

Y

N

N

N

Y

Consumables (Type/Description/Condition)

The type of consumable (such as ink) used by the printer, and the amount remaining.

N

N

N

Y

N

N

N

Y

Paper Feed Tray (Type/Name/Condition)

The type of paper feed tray used in the printer, and the amount of paper remaining.

N

N

N

Y

N

N

N

Y

Legend: Y: Can be collected. N: Cannot be collected.

Smart Device Information

Item

Description

Agent installed

Agentless

Windows

UNIX or Mac OS

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM#

API

IMEI

The ID number assigned to the mobile device.

N

N

N

N

N

N

Y

Y

UDID

An identifier assigned to smart devices made by Apple.

N

N

N

N

N

N

Y

Y

ICCID

A number assigned to the SIM card in smart devices manufactured by Apple.

N

N

N

N

N

N

Y

Y

IMSI

An ID number that identifies a subscriber of a mobile communication device. An IMSI is assigned to the SIM card of a smart device.

N

N

N

N

N

N

Y

Y

Contract phone number

The telephone number assigned to the subscriber.

N

N

N

N

N

N

Y

Y

E-mail

The E-mail address of the smart device.

N

N

N

N

N

N

Y

Y

Carrier

The company that provides the communication service used by the smart device.

N

N

N

N

N

N

Y

Y

Passcode or password setting

Whether a passcode or password is set on the device.

N

N

N

N

N

N

Y

Y

Internal storage (Free)

Internal storage

The internal storage capacity of the smart device.

Free

The free space available on the internal storage of the smart device.

N

N

N

N

N

N

Y

Y

External storage (Free)

External storage

The capacity of media (such as SD cards) installed in the smart device.

Free

The free space available on media (such as SD cards) installed in the smart device.

N

N

N

N

N

N

Y

Y

RAM (Free)

RAM

The memory capacity of the smart device.

Free

The amount of free memory available on the smart device.

N

N

N

N

N

N

Y

Y

Legend: Y: Can be collected. N: Cannot be collected.

#: Cannot be collected when Google Workspace is used as MDM System.

Microsoft Intune Information

Item

Description

Agent installed

Agentless

Windows

UNIX or Mac OS

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

Device ID

Device ID in Microsoft Intune.

A#1

N

N

N

N

N

A#2

N

Last Alive Confirmation Date/Time

Date/time that the device last connects to Microsoft Intune.

A#1

N

N

N

N

N

A#2

N

Last Capture Date/time

Date/time that JP1/IT Desktop Management 2 - Manager last captured from Microsoft Intune.

A#1

N

N

N

N

N

A#2

N

Legend: A: Can be collected conditionally. N: Cannot be collected.

#1: Can be collected when Managed computer on which Agent is installed is also managed by Microsoft Intune.

#2: This can be collected when Device type obtained when Microsoft Intune is used as MDM System is PC.

(4) Hardware information

This section describes the hardware information you can collect. Hardware information consists of the following:

Processor Details

Memory Details

Hard Disk Details

CD-ROM Drive Details

Removable Drive Details

Printer Details

Video Controller Details

Sound Card Details

Network Adapter Details

Monitor Details

Keyboard Details

Mouse Details

When using SNMP authentication, the device information that can be collected depends on the SNMP agent installed on the computer. This means that some device information might not be collected.

Processor Details

Item

Description

Agent installed

Agentless

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

Processor Details

The number of processors.

Y

Y

N

N

N

N

Y

Processor Name

The name of the processor.

Y#1

Y

Y

N

N

A#2

Y

Legend: Y: Can be collected. N: Cannot be collected. A: Can be collected conditionally.

#1: For devices with agents for UNIX or Mac installed, the list of devices in the Device Inventory view or in a CSV file exported by a command shows only one name even when there are multiple processors. The number of processors on a device with an agent for UNIX or Mac installed is shown on the Hardware Details tab in the Device Inventory view.

#2: You can collect it only when Google Workspace is used as MDM System and the OS type is "Chrome OS".

Memory Details

Item

Description

Agent installed

Agentless

Windows

UNIX

Mac OS

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

AIX

HP-UX

Solaris

Linux

Memory Details

The total amount of physical memory installed in the computer.

Y#2

N

N

N

Y

Y

Y

N

N

N

N

Y

Total Capacity

The amount of physical memory installed in the computer.

Y#2

N

N

N

Y

Y

Y

N

N

N

Y

Y

Slots

The total amount of physical memory installed in a memory slot. If the computer has several memory slots, the amount of memory in each slot can be collected.

Y#2

N

N

N

Y

Y

Y

N

N

N

N

Y

Virtual Memory Capacity#1

The total amount of virtual memory.

Y

N

N

N

N

N

Y

N

N

N

N

Y

Legend: Y: Can be collected. N: Cannot be collected.

#1:

The virtual memory capacity is the sum of the available physical memory and the total size of the page files.

#2:

For managed device whose physical memory and memory slot association information does not exist, these information cannot be collected. The association information of physical memory and memory slot can be checked using the following Windows PowerShell command. If the association information of physical memory and memory slot does not exist, no result is outputted by the command.

Get-WMIObject -class Win32_PhysicalMemoryLocation

In order to collect these information, please set the following registry in the managed device:

Key name

For 32-bit OS:

HKLM\SOFTWARE\HITACHI\JP1/IT Desktop Management - Agent

For 64-bit OS:

HKLM\SOFTWARE\Wow6432Node\HITACHI\JP1/IT Desktop Management - Agent

Value name

JdngGetAllUseMemoryInfo

Type

REG_SZ

Data

1

When the registry is set, memory details such as video memory is also acquired in addition to physical memory.

#3

Can acquire up to a maximum of 127 items.

Hard Disk Details

Item

Description

Agent installed

Agentless

Windows

UNIX or Mac OS

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

Hard Disk Details

The number of hard disk drives.

Y

Y*#6

Y

Y

N

N

N

Y

Disk names (Total Volume/Interface)#1

When there is more than one hard disk, the following information is collected for each disk:

Hard Disk Model

The model name of the hard disk drive.

Total Volume

The capacity of the hard disk. This item shows the total capacity regardless of how the drive is partitioned.

Interface

The interface of the hard disk drive, such as IDE or SCSI.

Y

Y*#6

Y

Y#2

N

N

Y#3

Y

Drive (Free/Total/File System)#4

When there is more than one hard disk, the following information is collected for each disk:

Free#5

The amount of free space on the drive.

Total#5

The total capacity of the drive.

File System#5

The name of the file system.

The string Locked by BitLocker appears when the system drive is locked by BitLocker.

Y

N

Y

N

N

N

N

Y

Legend: Y: Can be collected. Y*: Only AIX, Linux, or Mac OS can be collected. N: Cannot be collected.

Note: Drive information cannot be collected for network drives.

#1: In Windows Server 2019, Windows Server 2016 and Windows Server 2012, if the storage service has been used to create a virtual disk, the information for the virtual disk is obtained as if it is a physical disk.

#2: The Interface item cannot be collected.

#3: Only the Total Volume item can be collected.

#4: For a Windows agent, a drive letter (such as C: and D:) is obtained, For an agent for UNIX or Mac, a mount path is obtained,

#5: In Windows Server 2019, Windows Server 2016, Windows 10, Windows 8.1, Windows 8, Windows Server 2012, Windows 7, and Windows Server 2008 R2, information cannot be collected if BitLocker drive encryption is locked.

#6: Can acquire up to a maximum of 127 items.

CD-ROM Drive Details

Item

Description

Agent installed

Agentless

Windows

UNIX or Mac OS

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

CD-ROM Drive Details

The number of CD/DVD drives.

Y

N

Y

N

N

N

N

Y

CD-ROM Drive

The model name of the CD/DVD drive. If there are several CD/DVD drives, this information is collected for each drive.

Y

N

Y

N

N

N

N

Y

Legend: Y: Can be collected. N: Cannot be collected.

Removable Drive Details

Item

Description

Agent installed

Agentless

Windows

UNIX or Mac OS

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

Removable Drive Details

The number of removable drives.

Y

N

Y

N

N

N

N

Y

Legend: Y: Can be collected. N: Cannot be collected.

Printer Details

Item

Description

Agent installed

Agentless

Windows

UNIX or Mac OS

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

Printer Details

The number of printers set up on the computer.

Y

N

Y

N

N

N

N

Y

Printer Name (Type)

If there are several printers, the following information is collected for each printer:

Printer Name

The name of the printer.

Type

The printer type.

Y

N

Y

N

N

N

N

Y

Driver

The printer driver. If there are several printers, this item is collected for each printer.

Y

N

Y

N

N

N

N

Y

Shared Name

The shared name of the printer. If there are several printers, this item is collected for each printer.

Y

N

Y

N

N

N

N

Y

Server Name (Port)

If there are several printers, the following items are collected for each printer:

Server Name

The name of the printer server.

Port

The printer port.

Y

N

Y

N

N

N

N

Y

Legend: Y: Can be collected. N: Cannot be collected.

Video Controller Details

Item

Description

Agent installed

Agentless

Windows

UNIX or Mac OS

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

Video Controller Details

The number of video drivers.

Y

N

Y

N

N

N

N

Y

Video Chip

The name of the video chipset.

Y

N

Y

N

N

N

N

Y

VRAM Capacity

The amount of VRAM on the video card.

Y

N

Y

N

N

N

N

Y

Video Driver

The name of the video driver.

Y

N

Y

N

N

N

N

Y

Legend: Y: Can be collected. N: Cannot be collected.

Sound Card Details

Item

Description

Agent installed

Agentless

Windows

UNIX

Mac OS

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

Sound Card Details

The number of sound card drivers.

Y

N

Y

Y

N

N

N

N

Y

Product Name (Manufacturer)

The name and manufacturer of the sound card.

Y

N

Y#

Y

N

N

N

N

Y

Legend: Y: Can be collected. N: Cannot be collected.

#: Only the name of the sound card can be collected.

Network Adapter Details

Item

Description

Agent installed

Agentless

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

Network Adapter Details

The number of network adapters.

Y

Y

Y

N

N

Y

Y

Network Adapter

The name of the network adapter.

Y

Y

Y

N

N

Y#

Y

Legend: Y: Can be collected. N: Cannot be collected.

#: When Microsoft Intune is used as MDM system and the obtained device classification is "PC", either Wi-Fi or Ethernet is displayed on the network adapter. And, if Google Workspace is used as MDM System, you cannot retrieve it.

Monitor Details

Item

Description

Agent installed

Agentless

Windows

UNIX

Mac OS

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

Monitor Details

The number of monitors.

Y

N

Y

Y

N

N

N

N

Y

Monitor

The name of the monitor.

Y

N

Y

Y

N

N

N

N

Y

Legend: Y: Can be collected. N: Cannot be collected.

Keyboard Details

Item

Description

Agent installed

Agentless

Windows

UNIX or Mac OS

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

Keyboard Details

The number of keyboards.

Y

N

Y

Y

N

N

N

Y

Keyboard

The name of the keyboard.

Y

N

Y

Y

N

N

N

Y

Legend: Y: Can be collected. N: Cannot be collected.

Mouse Details

Item

Description

Agent installed

Agentless

Windows

UNIX or Mac OS

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

Mouse Details

The number of mouse.

Y

N

Y

Y

N

N

N

Y

Mouse

The name of the mouse.

Y

N

Y

Y

N

N

N

Y

Legend: Y: Can be collected. N: Cannot be collected.

(5) Installed software information

This section describes the information you can collect about installed software. Installed software information consists of the following:

When using SNMP authentication, the device information that can be collected depends on the SNMP agent installed on the computer. This means that some device information might not be collected.

Important

JP1/IT Desktop Management 2 cannot be distinguished as different software if there are multiple software with the same software name, version, and manufacturer.

In the case of a Windows agent

Software listed in Programs and Features

Information about the software registered in the Programs and Features section of the Windows Control Panel.

Important

If both of the following conditions exist, uninstall the software, and then delete the user account. If you delete the user account before the software is uninstalled, the relevant software information will remain as installed software information for JP1/IT Desktop Management 2.

- Software that appears only in the Programs and Features section of the Windows Control Panel is installed on the user's computer.

- You want to delete the user account used to install the software that meets the above condition.

Important

In Windows, you cannot delete the following information about Store apps installed on a computer. Therefore, the following information about Store apps will be detected and the apps will be recognized as installed software, even if the app itself does not appear in Programs and Features or Apps & features of Windows:

- Information about Microsoft Store system apps

- Information about installed Microsoft Store apps

- Information about Microsoft Store apps for which provisioning has been performed

Important

Information about software installed with for use only by the user who performed the installation as setting is collected when the user is logged in.

Software registered in Software Search Conditions

Information about software that is not registered in the Programs and Features section of the Windows Control Panel. By setting search conditions in the Software Search Conditions view of the Settings module, you can search for and collect information about executable files (with the extention exe, for example) on the computer.

Installed OS

Information about the OS installed on the computer.

For details about software search conditions, see (11) Defining search conditions for software information.

In the case of an agent for UNIX

The software information that can be collected depends on how the search is performed:

When Software installed by remote install is searched

Information on the software installed by JP1/IT Desktop Manager 2. This includes Hitachi program products and UAP.

When All software is searched

Information on the Hitachi program products (other than software installed by JP1/IT Desktop Manager 2), third party software, OS patch information, and the search result based on a search list. A search list can be used to search for information on any software that you set as a search target.

For details on the software information that can be collected for agents for UNIX, see the JP1/IT Desktop Management 2 - Agent Description and User's Guide (For UNIX Systems).

For details on the management of system information and software information for UNIX agents, see the JP1/IT Desktop Management 2 Distribution Function Administration Guide.

In the case of an agent for Mac

This applies to applications that are installed in a Mac OS and for which All software can be selected as a search method. By using a search list, you can find information about any software that you set as the search target. For details about how to manage the system information and software information of a Mac agent, see the JP1/IT Desktop Management 2 Distribution Function Administration Guide.

Software listed in Programs and Features, and Windows Store app

Item

Description

Windows Agent installed

Agentless

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

Software Name

The name of the installed software. If Windows Updates are registered in groups, the name of the group is displayed.

Y

Y

N

N

N

Y#2

Y

Version#1

The version of the installed software.

Y

Y

N

N

N

Y#2

Y

Software Vendor

The vendor of the installed software.

Y

Y

N

N

N

N

Y

Support URL

The URL of the support page for the installed software.

Y

Y

N

N

N

N

Y

Purchasing Status

The manner in which the software is licensed. Volume license version or Full-product version appears as the purchasing status.

Y*

Y*

N

N

N

N

N

Product ID

The product ID of Microsoft Office installed on the computer.

This item appears in the Software List view of the Inventory module if the purchasing status is Volume license version. The last five digits are replaced with asterisks in the Software List.

Y*

Y*

N

N

N

N

N

GUID

The globally unique identifier (GUID) of the installed software.

Y*

Y*

N

N

N

N

N

Software type

The type the installed software based on the information in the software dictionary. When the information in the software dictionary is offline-updated, information such as commercial software and freeware is displayed.

In a multi-server configuration, the software type is not reported to the higher management server. This information is collected by each management server.

Y

Y

N

N

N

N

N

Installation Date

The date on which the software was installed.

Y

Y

N

N

N

N

Y

Installation Folder

The installation path of the software.

Y

Y

N

N

N

N

Y

Windows Store app

Information indicating whether the target software is a Windows Store app.

Y

N

N

N

N

N

Y

Legend: Y: Can be collected. Y*: Only collected for some software. N: Cannot be collected.

Note: For a software program that appears only in Programs and Features of the user who installed the software program, its information can be collected while the user is logged in.

#1: If the software is a JP1 product, version is collected in the format of the JP1 product. However, for the case of JP1/TELstaff, JP1/VERITAS, and JP1/HIBUN, or when the managed node is agentless, the version displayed in Programs and Features is collected.

#2: You can only collect it when Microsoft Intune is used as MDM system.

Y* in the legend above means that the information can be collected only for the following Microsoft Office products:

Japanese versions of Microsoft Office products

Software Name

Edition

Microsoft Office

Microsoft Office Enterprise 2007#1

Microsoft Office Home and Business 2010#2

Microsoft Office Professional 2007

Microsoft Office Professional 2010#2

Microsoft Office Professional Plus 2007#1

Microsoft Office Professional Plus 2010#1

Microsoft Office Professional Plus 2013#1,#3

Microsoft Office Professional Plus 2016#1, #3

Microsoft Office Standard 2007

Microsoft Office Standard 2010#1

Microsoft Office Standard 2013#1, #3

Microsoft Office Standard 2016#1, #3

Microsoft Office Ultimate 2007#2

Microsoft Lync

Microsoft Lync 2010#1

Microsoft Lync 2013#1, #3

Microsoft Skype for Business

Microsoft Skype for Business 2016#1, #3

Microsoft Office Access

Microsoft Office Access 2007

Microsoft Access 2010

Microsoft Access 2013#1, #3

Microsoft Access 2016#1, #3

Microsoft Office Excel

Microsoft Office Excel 2007

Microsoft Excel 2010

Microsoft Excel 2013#1, #3

Microsoft Excel 2016#1, #3

Microsoft Office Groove

Microsoft Office Groove 2007

Microsoft Office InfoPath

Microsoft Office InfoPath 2007

Microsoft InfoPath 2010

Microsoft InfoPath 2013#1, #3

Microsoft Office InterConnect

Microsoft Office InterConnect 2007

Microsoft Office OneNote

Microsoft Office OneNote 2007

Microsoft OneNote 2010

Microsoft OneNote 2013#1, #3

Microsoft Office Outlook

Microsoft Office Outlook 2007

Microsoft Outlook 2010

Microsoft Outlook 2013#1, #3

Microsoft Outlook 2016#1, #3

Microsoft Office PowerPoint

Microsoft Office PowerPoint 2007

Microsoft PowerPoint 2010

Microsoft PowerPoint 2013#1, #3

Microsoft PowerPoint 2016#1, #3

Microsoft Office Project

Microsoft Office Project Professional 2007

Microsoft Project Professional 2010

Microsoft Project Professional 2013#1,#3

Microsoft Project Professional 2016#1, #3

Microsoft Office Project Standard 2003

Microsoft Office Project Standard 2007

Microsoft Project Standard 2010

Microsoft Project Standard 2013#1,#3

Microsoft Project Standard 2016#1, #3

Microsoft Office Publisher

Microsoft Office Publisher 2007

Microsoft Publisher 2010

Microsoft Publisher 2013#1, #3

Microsoft Publisher 2016#1, #3

Microsoft Office SharePoint Workspace

Microsoft SharePoint Workspace 2010

Microsoft Office Visio

Microsoft Office Visio 2007 Professional

Microsoft Office Visio 2007 Standard

Microsoft Visio 2010 Premium

Microsoft Visio 2010 Professional

Microsoft Visio 2010 Standard

Microsoft Visio Professional 2013#1,#3

Microsoft Visio Professional 2016#1, #3

Microsoft Visio Standard 2013#1, #3

Microsoft Visio Standard 2016#1, #3

Microsoft Office Word

Microsoft Office Word 2007

Microsoft Word 2010

Microsoft Word 2013#1, #3

Microsoft Word 2016#1, #3

#1: Collected only when the purchasing status is Volume license version.

#2: Collected only when the purchasing status is Full-product version.

#3: The product ID cannot be collected.

English versions or Chinese versions of Microsoft Office products

Software Name

Edition

Microsoft Office

Microsoft Office Enterprise 2007

Microsoft Office Professional 2007

Microsoft Office Professional Plus 2007

Microsoft Office Professional Plus 2010

Microsoft Office Professional Plus 2013#1,#2

Microsoft Office Professional Plus 2016#1, #2

Microsoft Office Standard 2007

Microsoft Office Standard 2010

Microsoft Office Standard 2013#1, #2

Microsoft Office Standard 2016#1, #2

Microsoft Lync

Microsoft Lync 2010

Microsoft Lync 2013#1, #2

Microsoft Skype for Business

Microsoft Skype for Business 2016#1, #3

Microsoft Office Access

Microsoft Office Access 2007

Microsoft Access 2010

Microsoft Access 2013#1, #2

Microsoft Access 2016#1, #2

Microsoft Office Excel

Microsoft Office Excel 2007

Microsoft Excel 2010

Microsoft Excel 2013#1, #2

Microsoft Excel 2016#1, #2

Microsoft Office Groove

Microsoft Office Groove 2007

Microsoft Office InfoPath

Microsoft Office InfoPath 2007

Microsoft InfoPath 2010

Microsoft InfoPath 2013#1, #2

Microsoft Office OneNote

Microsoft Office OneNote 2007

Microsoft OneNote 2010

Microsoft OneNote 2013#1, #2

Microsoft Office Outlook

Microsoft Office Outlook 2007

Microsoft Outlook 2010

Microsoft Outlook 2013#1, #2

Microsoft Outlook 2016#1, #2

Microsoft Office PowerPoint

Microsoft Office PowerPoint 2007

Microsoft PowerPoint 2010

Microsoft PowerPoint 2013#1, #2

Microsoft PowerPoint 2016#1, #2

Microsoft Office Project

Microsoft Office Project Professional 2007

Microsoft Project Professional 2010

Microsoft Project Professional 2013#1,#2

Microsoft Project Professional 2016#1, #2

Microsoft Office Project Standard 2007

Microsoft Project Standard 2010

Microsoft Project Standard 2013#1,#2

Microsoft Project Standard 2016#1, #2

Microsoft Office Publisher

Microsoft Office Publisher 2007

Microsoft Publisher 2010

Microsoft Publisher 2013#1, #2

Microsoft Publisher 2016#1, #2

Microsoft Office SharePoint Workspace

Microsoft SharePoint Workspace 2010

Microsoft Office Visio

Microsoft Office Visio 2007 Professional

Microsoft Office Visio 2007 Standard

Microsoft Visio 2010 Premium

Microsoft Visio 2010 Professional

Microsoft Visio 2010 Standard

Microsoft Visio Professional 2013#1,#2

Microsoft Visio Professional 2016#1, #2

Microsoft Visio Standard 2013#1, #2

Microsoft Visio Standard 2016#1, #2

Microsoft Office Word

Microsoft Office Word 2007

Microsoft Word 2010

Microsoft Word 2013#1, #2

Microsoft Word 2016#1, #2

#1: Collected only when the purchasing status is Volume license version.

#2: The product ID cannot be collected.

Software registered in the Software Search Conditions view

Item

Description

Windows Agent installed

Agentless

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

Software Name

The name of the installed software. If Windows Updates have been registered in groups, the name of the group is displayed.

Y

N

N

N

N

N

N

Version

The version of the installed software.

Y

N

N

N

N

N

N

Software Vendor

The vendor of the installed software.

Y

N

N

N

N

N

N

Software Installation Date

The date on which the software was installed.

Y

N

N

N

N

N

N

Installation Folder

The installation path of the software.

Y

N

N

N

N

N

N

Legend: Y: Can be collected. N: Cannot be collected.

Installed OS

Item

Description

Windows Agent installed

Agentless

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

Software Name

The name of the installed software.

Y

Y

N

N

N

N

Y

Version

The version of the installed software.

Y

Y

N

N

N

N

Y

Software Vendor

The vendor of the installed software.

Y

Y

N

N

N

N

Y

Installation Date

The date on which the software was installed.

Y

Y

N

N

N

N

Y

Installation Folder

The installation path of the software.

Y

Y

N

N

N

N

Y

Legend: Y: Can be collected. N: Cannot be collected.

(6) Security information

This section describes the information you can collect about a device's security. Security information consists of the following:

Windows Update Details

Antivirus Software Details

Windows Service Details

OS Security Details

Hibun Details

BitLocker Drive Encryption Details

When using SNMP authentication, the device information that can be collected depends on the SNMP agent installed on the computer. This means that some device information might not be collected.

Windows Update Details

Item

Description

Agent installed

Agentless

Windows

UNIX

Mac OS

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

Automatic update#1

Information indicating whether the automatic update feature is enabled.

Y

N

Y

Y

N

N

N

N

Y

Installed Updates#2

The number of installed updates.

Y

N

N

Y

N

N

N

N

Y

Article ID (Installation Date)#3

The name of the Windows update and the date when the update was installed.

Y

N

N

Y

N

N

N

N

Y

Legend: Y: Can be collected. N: Cannot be collected.

#1: For Windows, Collected when the Workstation service of the OS is running.

Note that for Windows, automatic update is displayed as enabled when all of the following conditions are true:

In Control Panel - Windows Update - Change settings, Important updates is set to Install updates automatically.

The Windows Update service is running. For agents whose operating systems are Windows 10, Windows Server 2019, or Windows Server 2016, the startup type of the Windows Update service is Automatic or Manual.

#2: When an installed program update is deleted, the information remains unupdated for up to three intervals of security monitoring. This is for preventing a false error when the information of the program update is unavailable just temporarily.

When the information of all installed program updates is no longer available, which was available previously, the system determines that the information collection failed and does not delete the collected information of the installed program updates.

#3 A hyphen (-) is displayed if information about the installation date could not be acquired.

Antivirus Software Details

Item

Description

Agent installed

Agentless

Windows

UNIX or Mac OS

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

Software Name

The name of the antivirus product.

Y

N

Y

N

N

N

N

N

Version

The version of the antivirus product.

Y

N

Y

N

N

N

N

N

Installation Date

The date on which the antivirus product was installed.

Y*

N

Y*

N

N

N

N

N

Scan Engine Version

The scan engine version of the antivirus software.

Y*

N

Y*

N

N

N

N

N

Virus Definition File Version

The version (date) of the definition file used by the antivirus product.

Y*

N

Y*

N

N

N

N

N

Auto Protect

The auto-protect setting (resident or non-resident) of the antivirus product.

Y*

N

Y*

N

N

N

N

N

Last Scanned Date/Time

The date and time when the computer was last scanned for viruses.

Y*

N

Y*

N

N

N

N

N

Legend: Y: Can be collected. Y*: Can be collected for some products. N: Cannot be collected.

For details about the antivirus software information you can collect, see (14) Supported anti-virus products.

Windows Service Details

Item

Description

Agent installed#

Agentless

Windows

UNIX or Mac OS

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

Windows Service Details

The display name of an active Windows service that is prohibited by a security policy.

Y

N

N

N

N

N

N

N

Legend: Y: Can be collected. N: Cannot be collected.

Note: This information is collected when the Workstation service is running on the OS. This function can manage up to 30 services.

#: Only collected from online-managed computers.

OS Security Details

Item

Description

Agent installed

Agentless

Windows

UNIX

Mac OS

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

Account Details#1

Account Name

The name of a local account. Account details are collected for each account name.

Y

N

Y

Y

N

N

N

N

Y

Days Since Last Password Change

The number of days since the account password was last changed.

For accounts that are disabled or expired or whose password must be changed at the next logon, the number of days since the last password change is not collected.

Y

N

Y

Y

N

N

N

N

Y

Password Strength#2

The strength of the password.

You can use the password definition file (jdng_security.xml) of the agent to set conditions for weak passwords. For details, see the description on customizing conditions for weak passwords in the JP1/IT Desktop Management 2 Configuration Guide.

Y

N

N

Y

N

N

N

N

Y

Password Never Expires

Whether the password is configured to never expire.

Y

N

N

Y

N

N

N

N

Y

Power On Password#3

Whether the computer has a power-on password.

Y

N

N

Y

N

N

N

N

Y

Guest Account

Whether or not a Guest account is configured on the computer.

Y

N

Y

Y

N

N

N

N

Y

Auto Logon

Whether automatic logon is enabled.

Y

N

Y

Y

N

N

N

N

Y

Shared Folder

Whether a shared folder is set up on the computer.

Y

N

N

Y

N

N

N

N

Y

Administrative share

Whether administrative shares are enabled.

Y

N

N

Y

N

N

N

N

Y

DCOM

Whether DCOM is enabled on the computer.

Y

N

N

Y

N

N

N

N

Y

Anonymous Access

Whether information can be collected by anonymous access.

Y

N

N

Y

N

N

N

N

Y

Screen Saver Details#4

Account Name

The name of the Windows local account. Screen Saver Details are collected for each account name.

Y

N

N

Y#5

N

N

N

N

Y

Screen Saver Settings

Whether a screen saver is enabled.

Y

N

N

Y#5

N

N

N

N

Y

Password

Whether the screen saver is password-protected.

Y

N

Y#6

Y#5

N

N

N

N

Y

Startup Time

The length of time before the screen saver activates.

Y

N

N

Y#5

N

N

N

N

Y

Firewall

Whether the Firewall is enabled.

Y

N

Y

Y

N

N

N

N

Y

Remote Desktop

Whether the remote desktop feature is enabled.

Y

N

N

Y

N

N

N

N

Y

Legend: Y: Can be collected. N: Cannot be collected.

Note: For Windows, this information is collected when the Workstation service of the OS is running.

#1 This function can manage the account information of up to 60 users.

For domain accounts, the password information might not be collected.

In addition, the target for the maximum number of users for account information is the number of users for which information of an account name and a password is collected.

#2: The following passwords are considered to have low strength:

Blank passwords

Passwords that match the account name exactly

A password that is the same character string as the account name, and consists of only upper case letters, only lower case letters, or has only the first letter capitalized.

A password that is the same character string as the computer name, and consists of only upper case letters, only lower case letters, or has only the first letter capitalized.

password, PASSWORD, or Password

admin, ADMIN, or Admin

administrator, ADMINISTRATOR, or Administrator

JP1/IT Desktop Management 2 for user accounts that are disabled, expired, or locked or whose password must be changed at the next logon, the strength of the password is not evaluated. When an account has a weak password, the last modified date/time of the password changes when its security is assessed. However, the password itself is left unchanged.

For Windows, if the Local Security Policy administrative tool (local environment, domain environment) is configured to enable Audit account management under Local Policies - Audit Policy, multiple event log might be recorded when the inventory is acquired.

#3 Power On Password represents the information set in Power-On Password in the BIOS. It is not a hard disk password. For some models, the information of power-on password cannot be collected and thus Unimplemented or Unknown can be displayed.

#4 The screen saver information of a logged-in user is collected and retained for 30 days since the last login. This function can manage the screen saver information of up to 60 users.

#5: When using an administrative share to collect device information, the system only collects information for the user who is logged on to Windows at the time of collection.

#6 For Mac OS, the judgement results indicate the results for all user accounts, instead of for each user account.

Hibun Details

Item

Description

Agent installed

Agentless

Windows

UNIX or Mac OS

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

Product Name

The full name of the installed product#1.

Y

N

N

N

N

N

N

N

Version

The version of the installed software.

Y

N

N

N

N

N

N

N

Patch Version

Information about the patches applied to the installed software.

Y

N

N

N

N

N

N

N

Login User ID

The user ID of the last user who logged in to the Hibun product.

Y#2

N

N

N

N

N

N

N

Last Login Date/Time

The time when a user last logged in to the Hibun product.

Y#2

N

N

N

N

N

N

N

Last Logout Date/Time

The time when a user last logged out from the Hibun product.

Y#2

N

N

N

N

N

N

N

Hibun DE (FS) Login Details

Login User ID

The user ID of the last user who logged in to the Hibun file server.

Y#3

N

N

N

N

N

N

N

Last Login Date/Time

The time when a user last logged in to the Hibun file server.

Y#3

N

N

N

N

N

N

N

Last Logout Date/Time

The time when a user last logged out from the Hibun file server.

Y#3

N

N

N

N

N

N

N

Drive

The local drive.

Y#2, #4

N

N

N

N

N

N

N

Encryption Status

The encryption status of the drive.

Y#2, #4

N

N

N

N

N

N

N

Legend: Y: Can be collected. N: Cannot be collected.

Note: The information in this table can be collected when the managed computer is running version 09-00 or later of the Hibun product.

#1: From version 10 and later, each pair of the following Hibun products (up to version 9) is considered to be the same:

JP1/Hibun IC and Hibun IC

JP1/Hibun IF and Hibun IF

JP1/Hibun IF Mail Option and Hibun IF Mail Option

JP1/Hibun IS and Hibun IS

#2: Not displayed for JP1/Hibun IF Mail Option, Hibun IF Mail Option, or Hibun DP.

#3: Displayed for Hibun DE.

#4: Displayed for JP1/Hibun IC, Hibun IC, and Hibun DE.

BitLocker Drive Encryption Details

Item

Description

Agent installed

Agentless

Windows

UNIX or Mac OS

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

Encryption Status

The encryption status of the drive.

Y

N

Y

N

N

N

N

Y

Legend: Y: Can be collected. N: Cannot be collected.

(7) Shared management items for asset information and device information

Item

Description

Input method/data type (default)

Agent installed

Agentless

Windows

UNIX or Mac OS

Administrative share

SNMP

ARP/ICMP

Active Directory

MDM

API

Department

The department where the user of the computer works.

Entry by adminstrator/Hierarchy

Y

N

N

N

N

Y

Y#2

Y

Location

The physical location of the computer.

Entry by adminstrator/Hierarchy

Y

N

N

Y#1

N

Y

N

Y

User Name

The name of the computer user.

Entry by administrator/Text

Y

N

N

N

N

Y

Y#2

Y

Account

The account of the computer user.

Entry by administrator/Text

Y

N

N

N

N

Y

N

Y

E-mail

The E-mail address of the computer user.

Entry by administrator/Text

Y

N

N

N

N

Y

N

Y

Phone

The telephone number of the computer user.

Entry by administrator/Text

Y

N

N

N

N

Y

N

Y

Legend: Y: Can be collected. N: Cannot be collected.

#1: Collected when location information is set in the SNMP agent.

#2: Collected when using Google Workspace as the MDM system to acquire device information with the OS type "Chrome OS".

(8) Criteria for device statuses

Device status

Criteria

Running

The current time is within 10 minutes of the last confirmation time plus the polling interval.

Stop

This status appears in situations like the following:

The current time is more than 10 minutes after the last confirmation time plus the polling interval.

Device information was collected for an offline-managed computer for the first time.#1

Warning

This status appears in situations like the following:

The current time is more than 10 minutes after the last confirmation time plus the polling interval, and network monitor is enabled on the agent.

Device information was collected for the first time for an offline-managed computer with the network monitor enabled.#2

The system fails to negotiate authentication with an agentless computer.

SNMP reports that a printer device is in Warning status (for example, toner is low).

Critical

SNMP reports that a printer device is unusable (for example, the printer is out of paper).

Unknown

This status appears in situations like the following:

Information about the device status could not be collected.

Device information was collected for the first time for an offline-managed computer.#1

Management by Management Server Under the Local Server

This device is in a multi-server configuration and is not placed directly under the server,

Note:

A computer with the network monitor agent installed might report several device statuses. In this case, the device status displayed in the modules is determined as follows:

The most severe status is displayed. In order of severity, the statuses are Critical, Warning, Stop, Running, and Unknown.

If the reported statuses have the same severity level, the device status reported for the most important system component is shown. The agent is the most important, followed by the network monitor agent.

#1

If ON is set for the OfflineRegistration_StatusUnknown property in the configuration file (jdn_manager_config.conf), the device status will be Unknown. In all other cases, the status will be Stop.

When device information is collected for the second or a subsequent time, the previous device status is retained. However, if ON is set for the OfflineRegistration_StatusUnknown property in the configuration file (jdn_manager_config.conf), the device status will be Unknown.

#2

Thereafter, the device retains its previous status.

(9) Timing of device information collection

Device information is collected from online management agents according to a regular schedule determined by the monitoring interval in the agent configurations. When an online management agent detects that device information has changed, it reports the device information to the management server. No information is reported if the device information is unchanged.

The following table lists the device information reported to the management server.

Detected item

Reported information

Monitoring interval

Host ID

All device information#1

Monitoring Interval (Others) (min)

Connection-target management server

All device information#2

Monitoring Interval (Others) (min)

System information

All information for detected items

Monitoring Interval (Others) (min)#3

Hardware information

All information for detected items

Monitoring Interval (Others) (min)

Installed software information

Information about additions, deletions, and changes among detected items

Monitoring Interval (Security) (min)#4

Security information

Automatic update

All information for detected items

Monitoring Interval (Security) (min)

Anti-virus product information

All information for detected items

Monitoring Interval (Security) (min)

Service security settings

All information for detected items

Monitoring Interval (Security) (min)

OS security settings

All information for detected items

Monitoring Interval (Security) (min)

Hibun information

All information for detected items

Monitoring Interval (Others) (min)

BitLocker drive encryption information

All information for detected items

Monitoring Interval (Others) (min)

Common management items

Entered by user

All device information for detected items

When the user finishes entering

Added management items

#1: If a host ID is changed, the agent determines that the device on which it is installed has changed, and reports a full set of device information.

#2: When the connection-target management server changes, the agent reports a full set of information to the new connection-target management server. Any instructions received from the previous connection target are retained.

#3: The Free Space attribute of the System Drive item in the computer information is collected once every 24 hours.

#4: Changes to the software information discovered in a software search are detected once every 24 hours.

(10) Collecting software information

JP1/IT Desktop Management 2 also collects software information when it collects device information from the computers it manages. You can view software information arranged by product name and version in the Software Inventory view of the Inventory module. If the agent is an agent for UNIX or Mac, you can also collect software information by executing the Get software information from computer (UNIX) job in addition to the notification automatically issued when the software becomes the management target.

Tip

An event is generated whenever software is added to a managed computer. By configuring email notification, you can have the administrator notified by email when software is added.

When software that is not registered in JP1/IT Desktop Management 2 is found on a managed computer, its discovery is reported in the Topic panel of the Home module. You can view a list of newly discovered software in the New Software panel of the Dashboard view in the Overview view of the Inventory module. You can also display the New Software panel in the Home module by selecting Panel Layout in the View menu at the top of the module.

Tip

The software programs in Software List (which you can display from Software Inventory of the Inventory module) are displayed by obtaining software information from the computer on which agents are installed. Note that Installation Software Total in Software List indicates the number of management-target computers. As such, software information is obtained from the detected devices and exclusion-target devices but is not included in Installation Software Total.

There are following types of software. For details about the items that can be collected for each type, see (5) Installed software information.

In the case of a Windows agent

Software registered in Programs and Features

Information about the software registered in the Programs and Features section of the Windows Control Panel. This information is collected from computers with the agent installed, and from agentless computers using authentication to administrative shares.

Software registered in Software Search Conditions

Information about software not listed in the Programs and Features section of the Windows Control Panel. You can specify these conditions in the Software Search Conditions view of the Settings module. JP1/IT Desktop Management 2 uses these conditions to find and collect information about executable files (such as exe files) on computers that have the agent program installed.

A search for software is conducted when the computer starts, and every 24 hours thereafter. The agent searches every local drive on the computer for software, and collects information about software that matches the software search conditions. If you want to collect software information at any time, execute the softwaresearch command. For details about the softwaresearch command, see the manual JP1/IT Desktop Management 2 Administration Guide.

Operating system information

Information about the operating system installed on a computer. This information can be collected from computers with the agent program installed, and from agentless computers using authentication to administrative shares.

Important

Agent and Agentless computers (with Windows 7) cannot collect information about the software that is installed on Windows XP Mode.

In the case of an agent for UNIX

The software information that can be collected depends on how the search is performed:

Software installed by remote install

Information on the software installed by JP1/IT Desktop Manager 2. This includes Hitachi program products and UAP.

All software

Information on the Hitachi program products (other than software installed by JP1/IT Desktop Manager 2), third party software, OS patch information, and the search result based on a search list. A search list can be used to search for information on any software that you set as a search target.

For details on software information collection for an agent for UNIX, see the JP1/IT Desktop Management 2 Distribution Function Administration Guide.

In the case of an agent for Mac

This applies to applications that are installed in a Mac OS and for which All software can be selected as a search method. By using a search list, you can find information about any software that you set as the search target. For details about how to collect software information from a Mac agent, see the JP1/IT Desktop Management 2 Distribution Function Administration Guide.

Setting software search conditions

As software search conditions, specify the executable file names you want to find.

You cannot create multiple software search conditions with the same execution file name. In a multi-server configuration, search conditions can overlap with those in other management servers.

If software that matches the search conditions is also present in the Programs and Features section of the Windows Control Panel, software information found by the search is not registered for that item.

If the search finds software with the same file name in different folders, information is collected for each piece of software, and several sets of software information are registered for software with the same name. You can distinguish between each piece of software by its installation path.

If a software program matches multiple search conditions, the information on the software program is obtained as separate software programs.

You can define software search conditions directly from the Settings module, or you can import conditions as a list. The search conditions you define apply to all computers with the agent installed. You cannot define separate sets of software search conditions for individual computers. For details about how to set software search conditions, see (11) Defining search conditions for software information.

Displaying computers with software installed

After collecting software information from managed computers, you can view a list of computers with a particular piece of software installed. This list appears on the Installed Computers tab of the Software Inventory view.

The following table lists the items shown on the Installed Computers tab.

Item

Description

Host Name

The host name of the managed computer with the software installed.

Manufacturer

The manufacturer of the computer with the software installed.

IP Address

The IP address of the computer with the software installed.

OS

The OS on the computer with the software installed.

User Name

The name of the user of the computer with the software installed.

Registered Date/Time

The date and time when the computer with the software installed was registered.

Installation Date

The date and time when the software was installed on the managed computer.

Acquiring software information from an agent for UNIX or Mac based on a search list

To search for software installed in an agent for UNIX or Mac with a search list, create a Get software information from computer (UNIX) job with All software set as search target software. Either the software search list stored in the manager or software search list stored in the agent is used.

Search list that exists in the agent

A search list saved in the agent when you searched for software using a search list last time.

User-specified search list

A search list saved in the manager where you can register any software you want to search for. You can create multiple search lists, for example, by the range of agents for UNIX or Mac, or by OS of the agent for UNIX or Mac to be searched for.

For how to create a user-specified search list, see the JP1/IT Desktop Management 2 Distribution Function Administration Guide.

Notes on Windows Store apps

Agent computers collect information about Windows Store apps that are installed in initial state of the OS.

Some Windows store apps that are installed in initial state of the OS are not displayed on the Windows Start menu or tile. But JP1/IT Desktop Management 2 collects those information.

Even if you uninstall Windows store apps that are installed in initial state of the OS, JP1/IT Desktop Management 2 collects the information.

In the same machine, even if one user updates Windows store apps, in the case that the other user does not update it, JP1/IT Desktop Management 2 collects information before and after update.

The software name of Windows Store apps displayed on JP1/IT Desktop Management 2 may not be the same as the name displayed on the Windows Start menu or tile. When you manage asset or perform security judgment of Windows Store apps, register the name of the Windows Store apps that is displayed on JP1/IT Desktop Management 2 - Manager.

The software name of Windows Store apps may change depending on language settings in the OS. When you manage asset or perform security judgment of Windows Store apps, register a proper name of the Windows Store apps.

(11) Defining search conditions for software information

By collecting software information from managed computers, you can see how software licenses are being used, monitor whether prohibited software and mandatory software are installed in keeping with a security policy, and gain a clear understanding of what software is installed on the computers in your organization.

The process for collecting software information depends on the type of software, as follows:

Software and Windows Store apps registered in the Programs and Features section of the Windows Control Panel

Software information is collected automatically from computers with the agent installed, and from agentless computers that support authentication by administrative shares.

Software not registered in the Programs and Features section of the Windows Control Panel

You can collect software information from computers with the agent installed by defining software search conditions.

By defining software search conditions, you can search computers for software that matches the conditions, and collect software information for discovered software. A search is conducted when the computer starts, and every 24 hours thereafter.

You can edit software search conditions when software is renamed or upgraded and its parameters change.

You can update several software search conditions at once by exporting, editing, and then importing the conditions. In a multi-server configuration, the search conditions applied by the higher management server are excluded from the export operation.

You can delete the software search conditions associated with software that no longer needs managing.

(12) Collecting user information

You can collect user information from computers with the agent installed by displaying an input window in which the user can enter the required information. This allows you to collect information like department names and asset numbers that JP1/IT Desktop Management 2 cannot collect automatically, which reduces the administrator's workload in data entry.

There are two types of user information you can collect:

Shared management items for asset information and device information

Information common to device information and hardware asset information.

Added management items for hardware asset information

Custom asset management items added to hardware asset information by an administrator.

You can use the Settings module to specify the date and time to allow users to start entering user information. If you specify the date and time, user information cannot be entered until the specified date and time is reached. When the local time of a user's computer reaches the specified date and time, a balloon tip appears and user information can be entered. Whether to display balloon tips can be selected in the User notification settings view for the agent configuration.

You can also set a schedule to collect user information on a regular basis from online-managed computers with the agent installed.

(13) Collecting registry information

You can collect registry information for computers as shared management items for hardware asset and device information, and as added management items for hardware asset information. By collecting registry information, you can use JP1/IT Desktop Management 2 to manage information specific to users and proprietary information defined by applications. Registry information can only be acquired from computers with the agent installed.

To collect registry information, you need to change the data source for the relevant items in the Asset Field Definitions view of the Settings module.

You must specify the root key and path of the registry entries that you want to collect. You can specify the following root keys:

HKEY_CURRENT_USER#

HKEY_LOCAL_MACHINE

HKEY_CLASSES_ROOT

HKEY_USERS

HKEY_CURRENT_CONFIG

#: When you specify a registry value under the HKEY_CURRENT_USER root key, the value is for the user who initiated the console session.

The formats of registry values are converted according to their data type. The following table shows how registry values of each data type are collected.

Data type

Collection method

REG_SZ, REG_EXPAND_SZ

The character string is not converted.

REG_MULTI_SZ

Information is collected in the form of several character strings connected by commas (,). For example: xxx,yyy,zzz

REG_DWORD#1

The numerical value is collected as a decimal character string.

REG_BINARY, REG_QWORD#2

Each byte of the binary value is converted to a hexadecimal character string, and the resulting strings are connected by spaces. For example: xx yy zz

#1: Not collected when the data type is REG_DWORD_BIG_ENDIAN.

(14) Updating device information

The device information on the management server is updated based on the information collected from managed computers.

The relative priority of device information depends on how the information is collected. For example, because device information for a computer with the agent installed is updated with information supplied by the agent, device information is not updated using information supplied by SNMP. The order of priority when updating device information is as follows:

Device information collected by the agent#1

Device information collected via a Windows administrative share

Device information collected via the API#3

Device information collected by SNMP

Device information collected from Active Directory

Device information collected by MDM linkage

Device information collected by ARP

Device information collected by ICMP (limited to confirming device presence)

Device information entered by an administrator#2

#1: Includes device information for offline-managed computers (excluding agents for UNIX or Mac) supplied via an online-managed computer.

#2: Information entered by an administrator always takes priority for the Device Type item. In a multi-server configuration, device information might be collected from a device at almost the same time as an administrator manually updates the device information. In this case, the device information might be inconsistent between the management server that manages the device information and the higher management server, and you must manually update the device information again.

#3: You can change the priority for updating device information collected via the API by editing the value set for the RestAPIInventoryUpdatePriorityLow property in the configuration file (jdn_manager_config.conf). For details about the RestAPIInventoryUpdatePriorityLow property, see A.5 Lists of properties.

The factors that determine whether device information is updated are how the new information was collected, and how the information already in the database was collected. The following table shows whether device information is updated for each combination of these factors.

Method of device information collection

Existing information

Entered by administrator

Collected from device

Not collected

Entered by administrator

Y#1

Y

Y

Collected from device

Data collected

Y#2

Y

Y

Collected with empty value

N

Y#3

Y#3

Not collected or value unchanged

N

N

N

Legend: Y: Device information is updated. N: Device information is not updated.

#1: An administrator can enter the Host Name, IP Address, Subnet Mask, Operating System, and Device Type items.

#2: Values of Device Type entered by an administrator always take priority, and are not replaced with information collected from a device.

#3: If the Host Name field is collected with an empty value, the device information is updated with the host ID.

Tip

When you collect device information from a device with more than one set of network information, the device information sometimes appears to relate to more than one device. In this case, to ensure that the number of devices is accurately tracked, only the device that matches the first set of network information is updated. Devices that match the other sets of network information are deleted. When this occurs, the date and time of agent deployment is aggregated in the remaining device information.

Tip

When using Microsoft Intune, the device hostname (device name in Windows and Android, and device name in iOS) must be unique.

(15) Information collected when updating device information

The following device information is collected when you update device information manually or as part of a regular search for devices:

Device type

System information

Hardware information

Installed software information

Windows Update information

Anti-virus product information

Service security settings

OS security information

Hibun information

BitLocker drive encryption information

Common Fields (Hardware Assets and Device Inventory)

Custom Fields (Hardware Assets)

(16) Events generated when updating device information

When an update to device information results in particular items being changed, added, or deleted, an event is generated and appears in the Events module.

The following table describes what actions cause events to be generated.

Item of device information

Event

Event trigger

Hardware information

Memory capacity

Changed

The new data differs from the existing data.

Hard disk

The following items of hard disk information:

Disk name

Capacity

Interface

Added

No part of the existing data exactly matches the new data.

Deleted

No part of the new data exactly matches the existing data.

Installed software information

Software name

Added

No part of the existing data exactly matches the new data, with the exception of Windows Update information.

Deleted

No part of the new data exactly matches the existing data, with the exception of Windows Update information.

Version

Changed

When data for a given Software Name differs in the new and existing data, with the exception of Windows Update information.

Security information

Automatic update

Changed

The new data differs from the existing data.

Service security settings

Added

The new data is not found in the existing data.

Deleted

The existing data is not found in the new data.

Account name in OS security settings

Added

The new data is not found in the existing data.

Deleted

The existing data is not found in the new data.

The following items for an account name in OS security settings:

Days since last password change

Password strength

Password never expires

Changed

The value of any of these items for a given account name differs in the existing and new data.

Power on password in OS security settings

Changed

The new data differs from the existing data.

Guest account in OS security settings

Changed

The new data differs from the existing data.

Auto logon in OS security settings

Changed

The new data differs from the existing data.

Shared folder in OS security settings

Changed

The new data differs from the existing data.

Administrative share in OS security settings

Changed

The new data differs from the existing data.

DCOM in OS security settings

Changed

The new data differs from the existing data.

Anonymous access in OS security settings

Changed

The new data differs from the existing data.

The following items of screen saver information in the OS security settings

Screen saver

Password

Startup time

Changed

The value of any of these items differs in the existing and new data.

Firewall in OS security settings

Changed

The new data differs from the existing data.

Remote desktop in OS security settings

Changed

The new data differs from the existing data.

(17) Collecting the device revision history

Users in an organization might change the computer configuration by, for example, inserting and removing a memory card, or installing or uninstalling software. It is not easy for the system administrator to find problems that are caused by changes, such as the theft of a memory card, or installation of software not permitted in the organization.

If information for devices managed by JP1/IT Desktop Management 2 changes, information before and after the change can be collected in the revision history. The revision history allows you to check only the device information that has changed, helping you find problematic changes easily. Check the revision history on a regular basis to confirm that no suspicious changes have been made.

To collect the revision history of a device, you must specify the collection of revision history in the Settings module on the management server that manages the device.

Process for collecting the revision history

If device information changed, the new device information is saved in the database. The new device information is compared with the old one at 0:00 everyday, and any differences are collected as the revision history for the day.

How to check the revision history

You can use the following two methods to check the collected revision history.

Checking the revision history displayed in the operation window

The Revision History view of the Inventory module allows you to check the latest revision history. This view displays a maximum of 600,000 entries in the revision history. If the number of entries exceeds 600,000, the oldest information is overwritten by the latest information.

Checking the revision history archive output to a CSV file

You can output the revision history archive to a CSV file. The output revision history archive allows you to retain information about the changes even if the revision history contains more than 600,000 entries. To output the revision history archive, you must specify the output settings during the setup.

Important

If you delete device information, the host name of the deleted device is not displayed in the Revision History view of the Inventory module. If you need to check the host name of the deleted device, check the revision history archive output to a CSV file.

The following figure shows an overview of collecting and checking the revision history.

(18) Device information which can be collected in revision history and the conditions to detect changes

The following table describes the device information items whose changes can be collected in the revision history, and when JP1/IT Desktop Management 2 detects changes in device information.

Device information item

Changes collected in revision history

Conditions to detect changes

Mode

Changes to the management mode (Discovered, Managed, or Ignored) are collected.

The management mode is changed as follows:

Discovered is changed to Managed.

Managed is changed to Ignored.

Ignored is changed to Managed.

Device information indicated as Managed is deleted.

Management Type

Changes to the following management types are collected:

Agent Management

Agentless Management (Authentication Successful)

Agentless Management (Authentication Failed)

MDM Linkage Management

API Management

The device information has changed since the last time it was collected.

Host Name#1

Changes to the host name collected as computer information in the system information are collected.

The device information has changed since the last time it was collected.

The host was changed in the operation window.

Case usage of the case-sensitive host name of an agent for UNIX or Mac is changed.

UUID (Computer Details)

Changes to the UUID collected as computer information in the system information are collected.

The device information has changed since the last time it was collected.

Note, however, that changes to only the case of hexadecimal alphabetic letters (A to F or a to f) are ignored.

Total Memory (Computer Details)

Changes to the amount of memory collected as computer information in the system information are collected.

The device information has changed since the last time it was collected.

External Storage Capacity (Smart Device Information)

Changes to the external storage capacity collected as smart device information in the system information are collected.

The device information has changed since the last time it was collected.

IMSI (Smart Device Information)

Changes to the IMSI collected as smart device information in the system information are collected.

The device information has changed since the last time it was collected.

IP Address (Network Details)#1, #2, #3

Changes to an IP address collected in Network Details in the system information are collected.

The device information has changed since the last time it was collected.

An IP address has changed in the operation window.

MAC Address (Network Details)#2

Changes to the MAC address collected in Network Details in the system information are collected.

The device information has changed since the last time it was collected.

Note, however, that changes to only the case of hexadecimal alphabetic letters (A to F or a to f) are ignored.

Processor Name (Processor Details)#2

Changes to the processor collected in Processor Details in the hardware information are collected.

The device information has changed since the last time it was collected.

Disk Name (Hard Disk Details)#2

Changes to the disk name collected in Hard Disk Details in the hardware information are collected.

The device information has changed since the last time it was collected.

Hard Disk Capacity (Hard Disk Details)#2

Changes to the hard disk capacity collected in Hard Disk Details in the hardware information are collected.

The device information has changed since the last time it was collected.

Drive Name (CD-ROM Drive Details) #2

Changes to the drive name collected in Drive Details in the hardware information are collected.

The device information has changed since the last time it was collected.

Video Chip (Video Controller Details)#2

Changes to the video chip collected in Video Controller Details in the hardware information are collected.

The device information has changed since the last time it was collected.

Video Chip VRAM Capacity (Video Controller Details)#2

Changes to the video chip VRAM capacity collected in Video Controller Details in the hardware information are collected.

The device information has changed since the last time it was collected.

Video Driver (Video Controller Details)#2

Changes to the video driver collected in Video Controller Details in the hardware information are collected.

The device information has changed since the last time it was collected.

Sound Card Product Name (Sound Card Details) #2

Changes to the sound card product name collected in Sound Card Details in the hardware information are collected.

The device information has changed since the last time it was collected.

Installed Software Details

Changes to the following items in Installed Software Details are collected:

Software Name

Version

Product ID

The device information has changed since the last time it was collected.

Department (Common Fields)

Changes to Department, which is a shared management item for asset information and device information, are collected.

The device information has changed since the last time it was collected.

The department has changed in the operation window.

The information is changed by importing a CSV file.

Location (Common Fields)

Changes to Location, which is a shared management item for asset information and device information, are collected.

The device information has changed since the last time it was collected.

The location has changed in the operation window.

The information is changed by importing a CSV file.

User Name (Common Fields)

Changes to User Name, which is a shared management item for asset information and device information, are collected.

The device information has changed since the last time it was collected.

The user name has changed in the operation window.

The information is changed by importing a CSV file.

#1: For a device that has one or more IP addresses with DHCP enabled, if the host name or an IP address is changed as follows, the changes in step 2 cannot be collected in the revision history.

The system administrator uses the operation window to change the device's host name or IP address for which DHCP is disabled.

After the above change, only the IP addresses for which DHCP is enabled are changed automatically.

In this case, the values of the device information and revision history displayed in the operation window are temporarily inconsistent. When the device information is collected the next day, the revision history is also collected and the values become consistent.

#2: If a device information item has multiple values, changes are collected if at least one value has been added, changed, or deleted. However, changes to only the order of values are not collected. The following table uses an example of Disk Name (Hard Disk Details) that has multiple values to show whether the revision history is collected.

Device information value

Revision history collected?

Before the change

After the change

HDDModel1, HDDModel2

HDDModel2, HDDModel3

Y

HDDModel1, HDDModel2

HDDModel1

Y

HDDModel1, HDDModel2

HDDModel1, HDDModel2, HDDModel3

Y

HDDModel1, HDDModel2

HDDModel2, HDDModel1

N

Legend: Y: Collected. N: Not collected.

#3: If DHCP is enabled for both the new and old IP addresses, the revision history is not collected. If DHCP is disabled for either the new or old IP address, the revision history is collected. The DHCP setting cannot be acquired if device information is collected by using SNMP or ICMP. If the DHCP setting cannot be acquired, the IP addresses are compared while DHCP is assumed to be disabled.

(19) Behavior after managed computers are disconnected from the network

If a managed computer loses network connectivity, the system attempts to connect to the computer at the interval specified in the agent configurations as if the computer were still connected to the network.

In this scenario, the management server cannot determine whether the managed computer has disconnected from the network or was switched off. Therefore, an online-managed computer that has disconnected from the network is assumed to have been turned off if a length of time equivalent to the server connection interval plus 10 minutes has elapsed since the last alive confirmation date/time. An agentless device is assumed to be turned off as soon as the management server is unable to collect information from the device.

During search for devices connected to the network, a managed device is not assumed to be turned off even if the management server is unable to collect information from the device. To check the status of an agentless device, select Update Device Details in the Device list or check the status after the information is updated regularly.

The device information for a computer remains unchanged until the computer reconnects to the network and JP1/IT Desktop Management 2 is able to collect up-to-date information for the computer.

Behavior of online-managed computers when disconnected from the network

Computers that are disconnected from the network are still subject to security policies. As a result, the following occurs:

The user is prevented from starting restricted software.

Blocked attempts to start restricted software are recorded as events on computers with the agent installed.

The user is prevented from using devices if the security policy prohibits their use.

Operation log entries are recorded.

Operation logs are stored locally in the agent-installed computer.

Tip

These do not occur on agentless computers. This is because the security status of an agentless computer is judged by assessing its device information against the security policy on the management server, not as a result of sending a security policy to the computer itself.

Behavior when computers reconnect to the network

When a computer reconnects to the network after a period of isolation, it uploads security-related items and the latest device information according to the monitoring interval specified in the agent configurations, not immediately upon reconnection. Events that were saved locally while the computer was isolated from the network are uploaded when the computer next communicates with the management server.

A user's computer uploads operation logs to the management server. When the computer reconnects to the network, all the operation logs stored on the computer are uploaded at the next scheduled upload time.

Assessment of security status

While a computer is isolated from the network, its security status continues to be assessed based on the information in the database that was collected by the management server before the computer became isolated from the network.

Tip

In the case of an agent for UNIX or Mac, when the device is disconnected from the network, the management server does not try to reconnect to the device, determine whether the power is on or off, obtain the operation log, nor perform security status assessment.

(20) Creating groups

Groups are classified into system-sorted groups (Device type, Network, Department, and Location) that are automatically created by the system and user-defined groups created by the system administrator. Devices are automatically sorted into groups according to the device information and hardware asset information. The created groups are displayed in the menu area.

The following describes how each type of group is created.

Device type

Groups are created according to the device types (such as PC, server, or printer) collected from devices. When device information is collected from a computer with the device type PC or Server, subgroups are created for each OS.

Network

Groups are created for each network address based on the IP addresses and subnet masks of devices.

Department

Groups are created based on the department information collected from devices. If an administrator has registered a department hierarchy in the Asset Field Definitions view of the Settings module, it is automatically reflected in the group hierarchy.

When linking with Active Directory, the OU hierarchy is reflected in the group hierarchy.

Location

Groups are created based on the location information collected from devices. If an administrator has registered a location hierarchy in the Asset Field Definitions view of the Settings module, it is automatically reflected in the group hierarchy. If you use SNMP to collect device information, the location values collected by SNMP are reflected in the created groups.

When linking with Active Directory, the location values collected for each computer are reflected in the created groups.

User-Defined

The system administrator adds groups in the Edit User-Defined List dialog box that opens from the menu area. The managed computers are automatically sorted into the corresponding groups according to the conditions specified for each group in the user definitions.

Related Topics:

2.4.3 Linking with Active Directory

(21) Process for definitions and groups for departments and locations

In the Settings module, you can edit definitions of departments and locations in device information collected from users. The definitions you added in the Settings module are automatically added as groups in the menu area of the Assets module and the Inventory module. You can also view a list of definitions that are deleted due to office reorganization or personnel changes and delete all these definitions at one time. To do this, use the Delete Hierarchies Used in Old Organization dialog box that opens from the menu area of the Assets module and the Inventory module.

Department and location groups can be edited in the menu area.

The following describes the available operations and results when editing definitions in the Settings module and when editing groups in the menu area.

When editing definitions in the Settings module

In the Settings module, you can do the following to edit information:

Add definitions

Delete definitions

Rename definitions

Change the position of a definition in the hierarchy

If you edit information in the Settings module, the changes are applied to the definitions, and not to the user information on the devices. If you add, rename, or rearrange a definition, a new group corresponding to the edited definition is added while the group for the definition before the change remains in the menu area. If you delete a definition, the group corresponding to the definition you deleted also remains in the menu area.

The following figure shows the results that are applied to the menu area and user information on the device when a definition is renamed and another definition is deleted in the Settings module.

When editing groups in the menu area

In the menu area, you can do the following to edit information:

Rename groups

Delete groups

If you edit groups in the menu area, the changes are also applied to the user information on the device registered in the group, in addition to the group definition.

The following figure shows the results that are applied to the definition and user information on the device when a group is renamed in the menu area.

Tip

Create department and location definitions that reflect how you intend to manage devices. If the definitions disagree with the user information, edit the user information so that devices are registered in the groups you defined, as intended. By doing so, an administrator can manage devices in groups aligned with his or her intentions.

Tip

This is automatically generated when information other than location names defined in the settings window is collected via a search.

Settings required after definitions and groups are edited

If definitions and groups are edited due to office reorganization or personnel changes, you must do the following.

If department definitions are added

Do the following for the added departments:

Assign security policies

Assign agent configurations

Add the department administrator to the administration scope

If department definitions are changed

Do the following for the changed departments, except for the case where you changed the definitions by using the ioassetsfieldutil import command:

Assign security policies

Assign agent configurations

Add the department administrator to the administration scope

In addition, delete the following asset information items associated with the department of the old organization, or associate them with another department:

Hardware asset information

Software asset information

Contract information

If a department definition is deleted

Delete the following asset information items associated with the deleted department, or associate them with another department:

Hardware asset information

Software asset information

Contract information

If a department group is deleted

Delete the following asset information items associated with the deleted department, or associate them with another department:

Hardware asset information

Software asset information

Contract information

(22) Overview of user-defined groups

User-defined groups, into which devices are sorted based on a given condition, can be edited in the menu area of the Security module and Inventory module.

You can assign security policies to user-defined groups. Unlike other groups, user-defined groups cannot be used for assigning agent configurations or reports.

Only one level of a user-defined group can be created. The name of a user-defined group can be a string with 256 or fewer ASCII characters other than control characters.

Devices are sorted according to the type of device information, target items, judgment condition, and judgment value specified in the user-defined group conditions. Therefore, you cannot directly sort devices into groups. A device that matches multiple user-defined groups is sorted into all the groups it matches. No devices are sorted into user-defined groups for which no conditions are set.

Type of device information

The type of device information of the target item. You can select Device list (sorted by system) (Device type, Network, Department, or Location) or Custom Field whose information is added by the system administrator.

Target items

The target item for the user-defined group conditions. If multiple target items are set, only the devices that meet the conditions for all the target items are sorted into groups.

Judgment conditions

The conditions used to compare the target item value with the judgment value. Devices are sorted into groups based on the result of the comparison.

Judgment value

The value that is compared with the target item according to the judgment condition.

The Devices for Which Conditions Do Not Apply group appears in the menu area by default. Devices that are not sorted into the user-defined groups created by the system administrator will be sorted into this group.

Judgment conditions and judgment values that can be specified for user-defined groups

Judgment conditions and judgment values that can be specified for a user-defined group vary depending on the type of device information. The following tables list the judgment conditions and judgment values that can be specified for each type of device information.

If Type of device information is Device list (sorted by system)

Judgment condition

Judgment value

Equals the judgment value

Hierarchy values displayed in the pull-down menu

Does not equal the judgment value

Equals the judgment value (including lower-hierarchy values)#

Does not equal the judgment value (including lower-hierarchy values)#

#: Cannot be specified if the target item is Network.

If Type of device information is Custom Field

Data type of judgement item

Judgment condition

Judgment value

Text

Equals the judgment value

Character string with 1 to 256 characters

The specified value is case sensitive. Single-byte characters are distinguished from double-byte characters during judgment.

Does not equal the judgment value

Begins with the judgment value

Ends with the judgment value

Contains the judgment value

Number

Equals the judgment value

-2,147,483,647 to 2,147,483,647

Does not equal the judgment value

Equal to or greater than the judgment value

Less than or equal to the judgment value

Greater than the judgment value

Less than the judgment value

Enumeration

Equals the judgment value

Value displayed in the pull-down menu

The specified value is case sensitive. Single-byte characters are distinguished from double-byte characters during judgment.

Does not equal the judgment value

When devices are sorted into user-defined groups

Devices are sorted into groups according to the specified user-defined group conditions when one of the following occurs:

The name of a user-defined group is changed.

A user-defined group is deleted.

User-defined group conditions are edited.

A device that belongs to the system-sorted group specified for the target item by the user-defined group conditions moves to another group.

The Custom Field information specified for the target item by the user-defined group conditions is updated.

The Custom Field information specified for the target item by the user-defined group conditions is deleted.

(23) Deleting duplicate device information

If an action such as reinstalling the operating system causes the agent program to be removed from a computer, a situation might arise in which the same device is registered more than once in the database. To delete duplicate device information:

In the Device Inventory view of the Inventory module, delete the device whose Last Modified Date/Time is farther in the past.

In the Device Inventory view of the Inventory module, sort the list of devices by MAC address. If two devices have the same MAC address, remove one of the devices.

(24) Size of inventory information collected from devices with agents for UNIX or Mac installed

The following table describes the maximum sizes of inventory information collected from devices with agents for UNIX or Mac installed:

Inventory type

Maximum size

System information

When the size of information to be collected exceeds 200 bytes, up to 200 bytes of the information can be collected.

Hardware information

When the size of information to be collected exceeds 200 bytes, up to 200 bytes of the information can be collected.

When the disk capacity or drive capacity exceeds 4 petabytes, the capacity is indicated as 4 petabytes.

Installed software information, software information

When the name of a software program exceeds 50 bytes, up to 50 bytes of the name can be collected.

When the version description of a software program exceeds 8 bytes, up to 8 bytes of the description can be collected.

2.6.3 Controlling devices

You can control the devices managed by JP1/IT Desktop Management 2. This section describes how to control devices in the following ways:

Send messages to users

You can send a message to a user of a computer. You can also send the same message to several computers at once.

Note that this function is not supported on the Citrix XenApp and Microsoft RDS server.

Control a computer's access to the network

You can permit or deny a computer network access.

Collect user information

You can collect information from users by displaying an input window on the user's computer.

Turn a computer on or off

You can restart computers remotely and turn computers on and off. This function can be used for device management, remote control, ITDM-compatible distribution, and distribution using Remote Install Manager.

Collect the latest device information

You can collect the latest device information any time you wish.

Define prohibited software

You can view a list of software installed on a computer, and designate certain software as prohibited software. This allows you to view the violation level of the computer in terms of installed software in the Security module. You can also prevent users from using certain software, or uninstall it remotely.

Uninstall software

You can uninstall software by selecting it from a list of software installed on a computer.

Remotely control a computer

You can access the desktop of a computer and control it remotely.

Control smart devices

You can lock, wipe, and reset passcodes on smart devices managed by JP1/IT Desktop Management 2.

Tip

In the case of an agent for UNIX or Mac, device control options you can perform are control of the network connection (only manual control for agents for UNIX) and collection of the latest device information. When you collect the latest information, the Get system information from computer (UNIX) and Get software information from computer (UNIX) jobs are executed. In addition,by default, notifications of system information and software information are sent every 24 hours (once a day) from agents for Mac to the management server.

Tip

Only network connection control for computers is possible with the use of the API. Registration of user information, on the other hand, is possible with the use of the API.

(1) Conditions for power control

This section describes the conditions that must be met to control the power status of a computer.

Conditions for turning on a computer

If there is a value for AMT Firmware Version in the device information, the system uses AMT to turn on the computer. If not, the system uses Wake on LAN. The following conditions must be met to turn on a computer:

Important

You cannot turn on a computer if any of the following apply:

The computer is suspended in battery mode

The computer is an agent for UNIX

The computer is an agent for Mac

Conditions on the management server

When using AMT

The AMT user ID and password must be registered in the AMT view under Inventory in Settings module.

In a multi-server configuration, you need to make settings on the management server that manages the device you want to turn on.

Port 16992 used by AMT must be available.

The name of the device to be turned on must be resolved from a host name.

The management server is connected to a wired LAN.

When using Wake on LAN

None.

Conditions on the computer

When using AMT

The computer is connected to the management server.

The agent is installed on the computer.

The computer supports AMT.

A computer supports AMT if a value appears for AMT Firmware Version in the device information.

The user name and password for AMT are entered in the BIOS settings.

Port 16992 used by AMT must be available.

The computer is connected to a wired LAN.

Tip

You can configure AMT in agent configurations which you can then apply to computers with the agent installed. This means that the administrator does not need to configure the BIOS on each computer individually.

Tip

You can register one combination of AMT user ID and password on a given management server. For this reason, when using AMT to turn computers on and off, the same ID and password must be used on each computer.

When using Wake on LAN

The computer is connected to the management server.

The agent is installed on the computer.

Wake on LAN is supported for wired LAN or wireless LAN.

Magic Packet mode is enabled in the Wake on LAN settings.

Conditions for turning off a computer

The following conditions must be met to turn off a computer:

Important

You cannot turn off a computer if any of the following apply:

The computer is a management relay server

The computer is a relay system

The computer is an agent for UNIX

The computer is an agent for Mac

Conditions on the management server

None.

Conditions on the computer

The computer is connected to the management server.

The agent is installed on the computer.

A Shutdown Computer dialog box appears on a computer you are turning off.

If there is no intervention by the user, the computer will shut down automatically after 180 seconds.

Note the following when shutting down a computer:

A computer will not shut down automatically if its screen saver is active and password protected.

A locked computer will not shut down automatically.

A computer will not shut down automatically if a user is working on an open file.

A computer will not shut down automatically if another user is logged on to the computer.

If the user has not yet logged on to the computer, the computer shuts down without displaying the Shutdown Computer dialog box.

If the computer is instructed to turn off by the management server while the Shutdown Computer dialog box is displayed, the latter instruction is ignored.

Conditions for restarting a computer

The following conditions must be met to restart a computer:

Important

You cannot restart a computer if any of the following apply:

The computer is a management relay server

The computer is a relay system

The computer is an agent for UNIX

The computer is an agent for Mac

Conditions on the management server

None.

Conditions on the computer

The computer is connected to the management server.

The agent is installed on the computer.

A Restart Computer dialog box appears on a computer you are restarting.

A computer is restarted at a time specified in the Settings to shut down and restart the computer area in the User notification settings view in the agent configuration. If the Automatically start if no response is received from the user within the specified period check box is selected in the agent configuration, and the user does not respond to the dialog box, the computer automatically restarts after the time period specified in the agent configuration elapses from when the dialog box was displayed. If the Follow the response of the user in the dialog box that instructs the user to shut down or restart the computer check box is selected in the agent configuration, the dialog box remains on screen, and the computer does not restart until the user clicks the appropriate button.

Note the following when restarting a computer:

A computer will not restart automatically if its screen saver is active and password protected.

A locked computer will not restart automatically.

A computer will not restart automatically if a user is working on an open file.

A computer will not restart automatically if another user is logged on to the computer.

If the user has not yet logged on to the computer, the computer restarts without displaying the Restart Computer dialog box.

If the computer is instructed to turn off by the management server while the Restart Computer dialog box is displayed, the instruction to turn off takes precedence. In this scenario, the Restart Computer dialog box is replaced with a Shutdown Computer dialog box.

(2) Prerequisites for using AMT

If the AMT version is lower than 6.0, a DHCP environment is a prerequisite. A wireless LAN environment is not supported.

The features of JP1/IT Desktop Management 2 have different requirements in terms of the AMT version required on the computer.

The following table shows the version of AMT required to use each feature.

Feature

Description

Required AMT version

Power control

Turns remote computers on and off.

3.0 to 16.0

Collecting AMT firmware versions

Collects the AMT version as part of a computer's device information.

Using IDE redirection#

Allows you to use CD-ROM drives remotely when using the remote control feature.

3.0 to 9.5

Remote control over RFB connections

Allows you to use the remote control feature over a RFB connection.

6.1 to 9.5

AMT configuration

Enable IDE redirection

This feature allows the use of the IDE redirection feature of AMT.

6.1 to 9.5

Enable remote KVM

By enabling remote KVM on a computer in the agent configurations, you can remotely control the computer over an RFB connection.

You can also set the authentication information needed to remotely control the computer.

Enable AMT and set passwords for AMT users with administrator permission

This feature enables AMT if disabled. You can also set the password for AMT users with administrator permission (the admin user).

7.0 to 16.0

#: In AMT versions 7.0 and 8.0, you cannot use the IDE redirection feature on computers on which AMT is enabled in the AMT Settings view in the Settings module.

To automatically enable AMT on a computer:

AMT must be enabled on a computer before you can use AMT-based features.

To automatically enable AMT on a computer, set an administrator-permission password used by AMT in the AMT Settings view of the Settings module.

You can then enable AMT automatically on computers and access them with administrator permission.

If there is no administrator password set for AMT on the computer, the password you enter in the AMT Settings view is registered in AMT. You cannot set a new password if one is already registered in AMT. In this case, specify the registered password. If an administrator password is set but AMT is disabled, you need to first enable AMT on the computer.

Enabling AMT on the computer starts the following services:

Service name: LMS

Display name: Intel(R) Management and Security Application Local Manage

Service name: UNS

Display name: Intel(R) Management and Security Application User Notification Service

To use these features, the management server must be configured in the following ways:

To control the power of a computer using AMT:

Set the credentials needed to communicate with AMT on the computer in the Set Credentials area of the AMT Settings view of the Settings module.

Thereafter, AMT will be used to control the power state of the computer.

To collect the AMT firmware version from a computer:

Set the credentials needed to communicate with AMT on the computer in the Set Credentials area of the AMT Settings view of the Settings module.

Thereafter, the AMT firmware version will be collected at the time when the device information is collected.

To remotely control a computer via RFB connection:

The remote KVM feature must be enabled in AMT on the remote computer.

You can edit agent configurations in the Windows Agent Configurations and Create Agent Installers view of the Settings module. In the AMT view, select the Allow Remote KVM check boxes.

If AMT is enabled on the computer, changes to AMT settings take effect each time the agent configurations are applied to the computer. If AMT is disabled on the computer, you need to configure the agent configurations to enable ATM automatically.

When you set up the computer in this manner, when an attempt by the remote control feature to connect to a computer using a standard connection fails, the remote control feature then attempts to connect using RFB. You can configure the system to use RFB when connecting from the Connect item in the File menu of the Remote Control view.

To use IDE redirection:

The IDE redirection feature must be enabled in the AMT settings on the computer. However, in AMT versions 7.0 and 8.0, you must set AMT from BIOS because you cannot use the IDE redirection feature, even if AMT is enabled on the computers.

Edit the agent configuration in the Windows Agent Configurations and Create Agent Installers view in the Settings module. At this time, select the Enable IDE redirection check box in AMT Settings.

If AMT is enabled on the computer, the AMT settings will be changed as soon as the agent configurations are applied. If the AMT is disabled on the computer, a configuration to automatically enable AMT on the computer is required.

In this way, you can use the IDE redirection feature when remotely controlling a computer.

In a multi-server configuration, the IDE redirection functionality can be used for a device that can be connected from the controller via the network.

Important

If you select the management window - Agent Configuration Items - AMT Settings tab - Allow IDE Redirection check box, AMT - SOL/IDER - Legacy Redirection Mode value is set to Enabled. This value is not set to Disabled even when you uninstall an agent, so you need to perform either of the following operations to disable it:

Clear the management window - Agent Configuration Items - AMT Settings tab - Allow IDE Redirection check box before uninstalling an agent.

Set AMT - SOL/IDER - Legacy Redirection Mode value to Disable after uninstalling an agent.

Related Topics:

(1) Conditions for power control

2.6.4 Managing offline computers

Besides network-accessible computers, JP1/IT Desktop Management 2 can manage computers that it cannot access over the network, including standalone computers and computers connected to an isolated network at a remote site.

The management of computers that cannot be accessed over a network is achieved by using external media to install the agent on the computer and collect device information.

This process of using external media to manage computers that the management server cannot access over the network is called offline management, in contrast toonline management which involves the management of computers that are connected to the management server by a network.

Storage capacity required on external storage devices

Device information is collected from offline-managed computers by an information collection tool stored on external media. The following free space must be available on the external media:

5 MB + (50 KB x the number of computers for which device information is collected)

There are some differences in management server capabilities depending on whether a computer is managed online or offline. For details on these differences, see (1) Functional differences between agent/agentless management.

Note that the offline management function is not supported on the Citrix XenApp and Microsoft RDS server.

Also, changing a setting of an offline-managed computer in the operation window requires re-execution of the installation set, the getinv.vbs command, or the setsecpolicy.vbs command tool. For details about configuration items that require re-execution of these commands, see the description about the conditions in which the tools must be re-executed on offline-managed computers in the manual JP1/IT Desktop Management 2 Administration Guide.

(1) Functional differences between agent/agentless management

There are some differences in management server capabilities depending on whether the managed computers have an agent installed or are agentless. In the case of computers with an installed agent, other differences arise depending on whether the computers are managed online or offline.

The following table describes functional differences by configuration type:

Function

Managed computers

Agent installed

Agentless

Online management

Offline management#1

Windows

UNIX

Mac OS

Acquisition of device information#2

Y

D

D

Y

D

Security diagnostics

Assign security policies

Y

Y

Y

Y

Y

Evaluate security

Y

N

D

Y

D#3

Actions at security policy violation

Automatic security measures

Y

N

N

D#9

N

Restrict printing

Y

N

N

Y

N

Disable data export

Y

N

N

D#10

N

Disable software startup

Y

N

N

Y

N

Acquire operation logs

Y

N

N

N

N

Send warning messages

Y

N

N

N

N

Power on/off

Y

N

N

N

N

Management of asset information

Manage hardware

Y

D#4

D#4

Y#5

D

Manage software licenses

Y

Y

Y

Y

D

Manage software

Y

Y

Y

Y

Y

Manage contracts

Y

Y

Y

Y

Y

Distribution of software and files

Distribute software

Y

Y#6

N

Y#6

N

Distribute files

Y

Y#6

N

Y#6

N

Uninstall software

Y

N

N

N

N

Remote control of devices

Remote control of computers

Y

N

Y#7

N

Y#7

Connection requests from computers

Y

N

N

N

N

File transfer

Y

N

N

N

N

Chat

Y

N

N

N

N

Management of device network connections

Enable network access control

Y

N

N

N

N

Control network connections

Y

Y

Y

N

Y

Report creation

Y

D#8

D#8

Y

D

Legend: Y: Supported. D: Depends on the collectable device information. N: Not supported.

#1: Agents for UNIX or Mac are excluded.

#2: The device information that can be collected depends on whether the computers have installed agents or are agentless. See the following for details on the information collected from each type of computer.

(1) Types of device information you can collect

(2) Device status information that can be collected

(3) System information that can be collected

(4) Hardware information

(5) Installed software information

(6) Security information

(7) Shared management items for asset information and device information

#3: Use the Windows Administrative Share feature to evaluate the security of agentless computers. Screensaver security cannot be determined on a per-account basis when using agentless management.

#4: Depends on the information. For details, see (4) Hardware information.

#5: USB devices cannot be registered.

#6: Only distribution using Remote Install Manager can be performed. ITDM-compatible distribution cannot be performed.

#7: RFB protocol must be used for remote control.

#8: Depends on the information. For example, software and device management status are supported, but security status is not supported.

#9: The automatic security measures are possible only when update programs are automatically applied, prohibited software is blocked to start, and the security of services or OSs is configured.

#10: Limit assets permitted to be used cannot be configured in the Allow registered USB device usage settings.

2.6.5 Agentless management

JP1/IT Desktop Management 2 can perform management without an agent having to be installed on the computers (agentless computers). This means that a computer used in research or a server used for business purposes, for example, on which management software cannot be installed for practical reasons, can still be managed under JP1/IT Desktop Management 2 in the same way as a user computer.

To use agentless management, configure computers discovered during a network search as managed computers.

Important

Configuring a computer for agentless management has security implications. Fully consider the effects before deciding to use agentless management.

Agentless management can be performed using Windows administrative shares, SNMP, or Active Directory. The three methods are described below:

Agentless management using Windows administrative shares

Non-resident executable programs are sent periodically to agentless computers via login to Windows administrative shares. The distributed programs collect device information using WMI.

Information is acquired at the following times:

When a network search is executed

At the update interval specified in the Agentless Management view

When you select Update Device Details from the Action menu in the Device list in the Inventory module.

Tip

You can also collect device information by selecting Update Device Details from the pop-up menu that appears when you right-click a computer name.

Important

Agentless management is based on executable programs for acquiring device information, sent from the management server to the managed computers. The Windows security settings block this operation by default. You must therefore lower the security level setting to allow the executable programs to be distributed. Consider how this will affect your system before deciding to change the security level.

Agentless management using SNMP

In this method, device information is collected periodically by SNMP, using authentication via the standard SNMP communication protocol. The information is collected at the same times as for agentless management based on Windows administrative shares.

Agentless management using Active Directory

In this method, device information is collected for devices managed by Active Directory.

Information is acquired at the following times:

When a network search is executed

When you select Update Device Details from the Action menu in the Device list in the Inventory module

Important

Agentless management using Active Directory collects information on the domain controller. If the domain controller and managed devices are out of sync, the collected information might differ from the information of the managed devices.

Setup must be performed on the computers to use Windows administrative shares, SNMP, or Active Directory. For details, see 4.2.8 Prerequisites for agentless management.

In agentless management, the functionality available from the management server differs in some respects from the functionality available when using installed agents. For details about the differences, see (1) Functional differences between agent/agentless management.

Important

To perform agentless security management, use Windows administrative shares.

(1) Functional differences between agent/agentless management

There are some differences in management server capabilities depending on whether the managed computers have an agent installed or are agentless. In the case of computers with an installed agent, other differences arise depending on whether the computers are managed online or offline.

The following table describes functional differences by configuration type:

Function

Managed computers

Agent installed

Agentless

Online management

Offline management#1

Windows

UNIX

Mac OS

Acquisition of device information#2

Y

D

D

Y

D

Security diagnostics

Assign security policies

Y

Y

Y

Y

Y

Evaluate security

Y

N

D

Y

D#3

Actions at security policy violation

Automatic security measures

Y

N

N

D#9

N

Restrict printing

Y

N

N

Y

N

Disable data export

Y

N

N

D#10

N

Disable software startup

Y

N

N

Y

N

Acquire operation logs

Y

N

N

N

N

Send warning messages

Y

N

N

N

N

Power on/off

Y

N

N

N

N

Management of asset information

Manage hardware

Y

D#4

D#4

Y#5

D

Manage software licenses

Y

Y

Y

Y

D

Manage software

Y

Y

Y

Y

Y

Manage contracts

Y

Y

Y

Y

Y

Distribution of software and files

Distribute software

Y

Y#6

N

Y#6

N

Distribute files

Y

Y#6

N

Y#6

N

Uninstall software

Y

N

N

N

N

Remote control of devices

Remote control of computers

Y

N

Y#7

N

Y#7

Connection requests from computers

Y

N

N

N

N

File transfer

Y

N

N

N

N

Chat

Y

N

N

N

N

Management of device network connections

Enable network access control

Y

N

N

N

N

Control network connections

Y

Y

Y

N

Y

Report creation

Y

D#8

D#8

Y

D

Legend: Y: Supported. D: Depends on the collectable device information. N: Not supported.

#1: Agents for UNIX or Mac are excluded.

#2: The device information that can be collected depends on whether the computers have installed agents or are agentless. See the following for details on the information collected from each type of computer.

(1) Types of device information you can collect

(2) Device status information that can be collected

(3) System information that can be collected

(4) Hardware information

(5) Installed software information

(6) Security information

(7) Shared management items for asset information and device information

#3: Use the Windows Administrative Share feature to evaluate the security of agentless computers. Screensaver security cannot be determined on a per-account basis when using agentless management.

#4: Depends on the information. For details, see (4) Hardware information.

#5: USB devices cannot be registered.

#6: Only distribution using Remote Install Manager can be performed. ITDM-compatible distribution cannot be performed.

#7: RFB protocol must be used for remote control.

#8: Depends on the information. For example, software and device management status are supported, but security status is not supported.

#9: The automatic security measures are possible only when update programs are automatically applied, prohibited software is blocked to start, and the security of services or OSs is configured.

#10: Limit assets permitted to be used cannot be configured in the Allow registered USB device usage settings.

(2) Prerequisites for agentless management

When using agentless management, setup must be completed on both the management server and user computer to collect device information. The range of information that can be acquired depends on the authentication method. The range of information that can be acquired depends on the authentication method. A limited range of information may result in unknown security states and missing data in reports, causing risks to system operation. Select the best authentication method for your security needs.

Setup to collect most of the available device information is easy if you are using Active Directory to manage the computers in your organization. If you are thinking of using agentless management, first make sure that your computers are managed in Active Directory.

For differences between the types of device information that can be collected, see 2.6.2 Collecting device information.

Important

Agentless management is not supported in a NAT environment.

Important

Do not delete the discovery range or authentication information for any agentless managed device discovered in a network search. Likewise, do not delete the Active Directory setting for any agentless managed device discovered by an Active Directory search. Deleting this setting information prevents device information from being collected. If you mistakenly delete the discovery range, authentication information, or Active Directory setting, add them and then re-execute the network search or Active Directory search to discover the devices.

Important

In a DHCP environment, if a device's IP address changes, moving outside the discovery range, no information will be collected about that device.

When using Windows administrative shares to perform agentless management

All the following conditions must be satisfied:

Windows firewall is disabled on the user's computer#1.

Simple file sharing is disabled on the user's computer.

File and Printer Sharing is enabled on the user's computer.

Windows Administrative Share (ADMIN$) is enabled on the user's computer.

Access to the Interprocess Communications share (IPC$) is enabled on the user's computer.

The information used for logging in to the target computer by using Windows administrative shares is set on the management server as authentication information for network searches.#2

#1: Even if Windows Firewall is enabled, the condition is still satisfied if TCP (port 445) is open for traffic.

#2: The authentication information for logging in to the target computer by using Windows administrative shares must satisfy either of the following conditions:

The built-in Administrator account and password of the user's computer is used.

The UAC function is disabled on the user's computer.

How to make Windows administrative shares accessible to a management server varies depending on the OS on the user's computer. The following settings are required to make Windows administrative shares accessible:

OS

Setting

Windows 10

Disable UAC or enable the Administrator account.#1

Enable File and Printer Sharing in the Network and Sharing Center window.

Windows 8.1

Windows 8

Windows 7

Windows Vista

Disable UAC or enable the Administrator account.

Enable File sharing in the Network and Sharing Center window.

Windows XP#2

Disable simple file sharing.

Add file shares.

Windows Server 2019

Enable File sharing or File and Printer Sharing in the Network and Sharing Center window.

Windows Server 2016

Windows Server 2012

Windows Server 2008

Windows Server 2003

Setup unnecessary (enabled by default).

Windows 2000

Add file shares.

Computer other than Windows

Not supported (cannot be configured).

Network device

Not supported (cannot be configured).

#1: If you are using Windows 8.1 or Windows 8 (no edition), perform this setup by executing the net user command at the command prompt. You cannot enable the Administrator account from the Windows Control Panel.

#2: In Windows XP Home Edition (Service Pack 2 and 3), Windows administrative shares cannot be used.

If these conditions are satisfied, you can acquire most of the available device information. The information collected hardly differs from that collected via agents installed on the managed computers.

When using SNMP to perform agentless management

The following conditions must be satisfied:

SNMP can be used.

The community name can be authenticated.

The following table describes the setup required to acquire device information using SNMP:

OS

Setting

Windows 10

Install an SNMP agent.

Set up the SNMP agent.

Windows 8.1

Windows 8

Windows 7

Windows Vista

Windows XP

Windows Server 2019

Windows Server 2016

Windows Server 2012

Windows Server 2008

Windows Server 2003

Windows 2000

Computer other than Windows

Network device

When using Active Directory to perform agentless management

Both the following conditions must be satisfied:

Windows firewall is disabled on the user's computer.#

Using the Active Directory linkage feature, the management server can acquire device information managed by Active Directory.

#: If Windows firewall is enabled, the condition is still satisfied if connection via a port number specified in Active Directory settings view accessed from General view in the Settings module is open for traffic.

When using ICMP to perform agentless management

ICMP must be available for use.

The following table describes the setup required to acquire device information using ICMP:

OS

Setting

Windows 10

Allow incoming ICMP echo requests.#

Windows 8.1

Windows 8

Windows 7

Windows Vista

Windows XP

Windows Server 2019

Windows Server 2016

Windows Server 2012

Windows Server 2008

Windows Server 2003

Windows 2000

Computer other than Windows

Network device

#: In Windows XP or later, you must configure the Windows Firewall to allow ICMP traffic or disable Windows Firewall.

Related Topics:

(1) Types of device information you can collect

(2) Device status information that can be collected

(3) System information that can be collected

(4) Hardware information

(5) Installed software information

(6) Security information

(7) Shared management items for asset information and device information

(3) Configuring authentication information for agentless devices

In the case of agentless devices, information is acquired using a combination of the discovery range and authentication information set for network searches. The acquisition process uses the authentication information set for the discovery range that contains the devices' IP addresses.

The authentication information used for agentless devices can be also set after completion of a discovery.

To set authentication information for an agentless device:

Open the Inventory module.

Select a group under Device Inventory in the menu area.

Select an agentless device in the information area.

From the Action menu, select Set Credentials.

Set authentication information in the displayed dialog box.

Click the OK button.

The authentication information to be used for the selected agentless device is now set.

Tip

You can also set authentication information in the IP Address Range view accessed from Configurations in the Settings module.

Tip

For Update interval set on Agentless Management, authentication is performed based on previous successful authentication information of the network discovery. Only changing the authentication information setting will not update previous successful authentication information of the network discovery. In this case, perform discovery from the network discovery screen, and make sure the authentication is successful in order to update the authentication information. Please note that although new authentication information is used when performing Update Device Details, previous successful authentication information of the network discovery will not be updated even if the authentication succeeded.

(4) Acquiring information from agentless devices

The following methods are available for acquiring device information from agentless devices.

Administrative shares

Device information is acquired using authentication to Windows administrative shares. Almost the same level of information is collected as when using installed agents.

SNMP

Device information is acquired using SNMP authentication. Only a portion of the device information can be collected.

Active Directory

Device information is acquired with reference to the device information managed by Active Directory. Only a part of device information (that can be acquired by Active Directory) can be collected.

ARP

Device information is acquired from ARP. Only a portion of the available device information can be collected.

ICMP

Device presence is verified using ICMP (PING). Only IP address information can be collected.

Information is acquired from managed agentless devices using administrative shares or SNMP. ARP and ICMP are used only for devices on which administrative shares or SNMP authentication have failed. ARP and ICMP are never used for devices on which administrative shares or SNMP authentication have succeeded.

Whether acquisition is based on administrative shares or SNMP depends on the discovery range and authentication information set in the discovery settings. Information is collected from an agentless device using the authentication information set for the discovery range in which the device's IP address falls. No information is collected if the IP address is outside the discovery range, or if no authentication information has been set, or if authentication fails.

For agentless devices, the available collection methods differ according to the device type, as shown in the table below:

Collection method

Device type

Windows computer

OS other than Windows

Network device

Administrative shares

Y

N

N

SNMP

Y

Y

Y

Active Directory

Y

N

N

ARP

Y

Y

Y

ICMP

Y

Y

Y

Legend: Y: Can be used. N: Cannot be used.

Timing of device information acquisition

Device information is collected from agentless devices at the following times:

When a network search is executed

When you select Update Device Details from the Action menu in the Device list in the Inventory module.

To change the collection interval, set the update interval in the Agentless Management view under Agent in the Settings module. The default update interval is one hour.

By selecting Update Device Details in the Inventory module, you can collect device information at any time you wish.

Device information is not acquired during intensive discovery.

Important

If Active Directory is used, the device information is collected when a search for a device registered in Active Directory is performed.

Tip

For Update interval set on Agentless Management, authentication is performed based on previous successful authentication information of the network discovery. Only changing the authentication information setting will not update previous successful authentication information of the network discovery. In this case, perform discovery from the network discovery screen, and make sure the authentication is successful in order to update the authentication information. Please note that although new authentication information is used when performing Update Device Details, previous successful authentication information of the network discovery will not be updated even if the authentication succeeded.

Related Topics:

(5) Mechanism for acquiring device information from agentless devices

(3) Configuring authentication information for agentless devices

(5) Mechanism for acquiring device information from agentless devices

To acquire device information from an agentless computer using authentication to administrative shares, executable programs are sent to the computer.

Three executable programs are sent:

jpngmain.exe

jpnmspushlauncher.exe

jpnmspushservice.exe

These three executable programs generate administrative share files for reporting the collected device information on the computer. The files are then relayed to the management server and device information about the agentless computer is updated.

The executable programs are distributed only at the first run and when the executable programs are upgraded. They are not deleted automatically. If the management server is upgraded or if any of the executable program files are deleted, the executable programs are resent.

Important

Never delete these executable programs. Deleting them might stop the agentless management functionality from working properly. Anti-virus products installed on a computer can result in an executable program being mistakenly detected as a virus and failing to execute correctly. In such cases, install a management agent

Tip

If login to a Windows administrative share is successful, approximately 2.5 MB of executable code is sent to each computer.

2.6.6 Linking with an MDM system

You can manage smart devices in JP1/IT Desktop Management 2 by linking with an MDM system and collecting information about the smart devices it manages. You can then manage the information in JP1/IT Desktop Management 2, and use the features of JP1/IT Desktop Management 2 to control smart devices.

To link with an MDM system in a multi-server configuration, you must link with an MDM system for each management server.

The following table shows the features made possible by linking with an MDM system:

Feature

Description

Collecting information about smart devices

You can collect information about the smart devices managed by an MDM system, and use the information to manage those devices in JP1/IT Desktop Management 2. By collecting information periodically from the MDM system, you can manage the device information, asset information, and security status of individual smart devices.

Control smart devices#

JP1/IT Desktop Management 2 can lock, wipe, and reset passcodes on smart devices managed by an MDM system.

Note: If Google Workspace is used as MDM System, you cannot manage the security status of collecting information about smart devices. In addition, control smart devices function cannot be used.

#: If Microsoft Intune is used as MDM system, the passcode is cannot be reset. Also, if Microsoft Intune is used as MDM system and the device classification is "PC", the device cannot be locked.

Tip

When using Microsoft Intune as an MDM system, you can manage PCs whose operating system is Windows in addition to smart device.

Tip

When you use Microsoft Intune as a MDM system, you do not consume licensing for device that you manage with Microsoft Intune. However, among devices managed by Microsoft Intune, if the agent is installed on a PC with a Windows OS, the license of the device will be consumed.

Tip

If you use Microsoft Intune as MDM System and manage Windows PCs, you can also deploy Agent in this PC. In this situation, Management Type will be "Agent Management", but you can also manage information from Microsoft Intune. The use of this kind of management in Agent together with the management in Microsoft Intune is called combined management.

Tip

If you use Google Workspace as MDM System, you can manage ChromeOS and ChromeOS Flex devices. In addition, you can manage only devices that have Status provisioned on Google Workspace.

Tip

When you use Google Workspace as a MDM system, you do not consume licensing for device that you manage with Google Workspace.

Related Topics:

(1) Collecting information for smart devices managed by an MDM system

(2) Device information that can be acquired from MDM systems

(4) Notes on MDM linkage

2.23 Controlling smart devices

(1) Collecting information for smart devices managed by an MDM system

You can collect information about smart devices managed by an MDM system, allowing you to use the features of JP1/IT Desktop Management 2 to manage the device information, asset information, and security status of smart devices. You can keep the information up-to-date by collecting the latest information.

Tip

Like other devices, each smart device managed by JP1/IT Desktop Management 2 uses one product license.

The following figure shows how smart device information is collected from an MDM system.

You can use the following methods to collect information about smart devices managed by an MDM system:

Immediate

JP1/IT Desktop Management 2 connects to the MDM system immediately and collects information about smart devices. Use this option when you first install JP1/IT Desktop Management 2 or when you want changes to the information in the MDM system to be immediately reflected in the JP1/IT Desktop Management 2 database.

Scheduled

Smart device information is collected regularly according to the MDM linkage settings. Discovered devices are automatically made management targets. The schedule is determined by the values in Start At, Repeat Interval (daily, weekly, or monthly), and Repeat in the Settings module. By default, no schedule is set.

Tip

When you delete a smart device from an MDM system, the corresponding information is not deleted from JP1/IT Desktop Management 2. When you remove a smart device from an MDM system, you can remove the device from JP1/IT Desktop Management 2 by deleting its device information.

(2) Device information that can be acquired from MDM systems

The following table lists the device information you can obtain from an MDM system.

System information

Important

If you deploy managed devices with Agent and managed devices are managed by Microsoft Intune, Device inventory is retrieved from Agent instead of Microsoft Intune.

Device information item

Whether device information can be acquired

Corresponding item in the source MDM system

Contents

In the case of JP1/ITDM2 - SDM#1

In the case of MobileIron

For Microsoft Intune

For Google Workspace

Device Type

Si, SA, M, IS

--

--

--

--

Smart Device is set as the device type.

IP, G

--

--

--

--

"PC" is set.

Computer Details

Computer Name (Description)

Si, SA, M, IS, IP

One if the following is displayed:#2

Managed Smart Device List - Name

A combination of the following items is displayed.

System Information - User

System Information - Phone Number

Hardware - Model

--

Name

Serial number

The device name#2, user name, contract phone number, and model name used to identify the device in the MDM system.

Host Name

Si, M, IS, IP, G

Model (Manufacturer)

Model

Si, SA, M, IS, IP, G

Manufacturer

Si#3, SA, M, IS, IP

A combination of the following items is displayed.

Hardware - Model

Hardware - Manufacturer Name

--

Displays a combination of the following items.

Hardware - Model

Hardware - Manufacturer

Devices > Chrome > Devices > "Serial number" > General > Basic Info > Hardware model

The name of the manufacturer of the device, and the model name assigned by the manufacturer.

UUID

G

--

--

--

Devices > Chrome > Devices > "Serial number" > General > Basic Info > Directory API ID

UUID is retrieved.

Serial #

Si, SA#3, M, IS, IP, G

Hardware - Serial #

SerialNumber

Hardware - Serial number

Devices > Chrome > Devices > "Serial number" > General > Basic Info > Serial number

The serial number of the device.

Memory

SA, M, IS, IP, G

Hardware - RAM

total_ram_size_bytes

Hardware - Total physical memory

Devices > Chrome > Devices > "Serial Number" > Hardware > Memory > Memory usage

The total memory installed in the device.

System Drive-[Logical Drive]

Drive letter

G

--

--

--

mounted/connected volume id

The drive type or mount path is obtained.

Free

G

--

--

--

free disk space on the mounted/connected volume

The free space on the drive is obtained.

Capacity

G

--

--

--

total disk space on the mounted/connected volume

Size of Drive is retrieved.

BIOS Details

Serial number

IP, G

--

--

Hardware - Serial number

Devices > Chrome > Devices > "Serial number" > General > Basic Info > Serial number

The serial number of BIOS is obtained.

OS Details

OS

Si, SA, M, IS, IP, G

A combination of the following items is displayed.

System Information - OS

System Information - OS Version

OS

Displays a combination of the following items.

Operating system

Operating system version

Displays a combination of the following items.

Devices > Chrome > Devices > "Serial number" > General > Basic Info > ChromeOS type

Devices > Chrome > Devices > "Serial number" > OS > OS versions

The name and version of the operating system.

Network Details

Network adapter name

IP

--

--

--

--

"Wi-Fi" is set for Wi-Fi and "Ethernet" for Ethernet.

MAC Address

Si, SA, M, IS, G

Hardware - WiFi MAC Address

Hardware - Bluetooth MAC Address

WiFiMAC

wifi_mac_addr

BluetoothMAC

Hardware - Wi-Fi MAC

Devices > Chrome > Devices > "Serial number" > Network > Network details > MAC address

The MAC address of the device.

IP

--

--

Hardware - Wi-Fi MAC

Hardware - Ethernet MAC

--

MAC addressis obtained. If both "Hardware - Wi-Fi MAC" and "Hardware - Ethernet MAC" are obtained, they are displayed in this order, and "Hardware - Wi-Fi MAC" is MAC address of representation. If only one of the data is available, only that data is displayed.

Smart device information

IMEI

Si, SA, M, IS, IP

Hardware - IMEI

imei

Hardware - IMEI

--

The IMEI that identifies the smart device.

UDID

Si, M, IS

Hardware - UDID

udid

Hardware - UDID

--

The UDID assigned to Apple smart devices.

IMSI

Si, SA, M

System Information - SIM Card

imsi

registration_imsi

current_SIM_module_number

--

--

The IMSI assigned to the SIM card of smart devices that the telecommunications company uses to identify the subscriber.

ICCID

Si, SA, M, IS, IP

Hardware - ICCID

--

Hardware - ICCID

--

The ICCID number assigned to the SIM card of the smart device.

Model (Manufacturer)

Model

Si, SA, M, IS, IP

Manufacturer

Si#3, SA, M, IS, IP

A combination of the following items is displayed.

Hardware - Model

Hardware - Manufacturer Name

--

Displays a combination of the following items.

Hardware - Model

Hardware - Manufacturer

--

The name of the manufacturer of the smart device, and the model name assigned by the manufacturer.

Serial #

SA#3, Si, M, IS, IP

Hardware - Serial #

SerialNumber

Hardware - Serial number

--

The serial number of the smart device.

Contract phone number

Si, SA, M, IS, IP

System Information - Phone Number

Number

Hardware - Phone number

--

The telephone number used by the smart device.

E-mail

Si, SA, M

System Information - E-mail address

--

--

--

The E-mail address used by the smart device.

Carrier

Si, SA, M, IS, IP

System Information - SIM Card

current_operator_name

Operator

Hardware - Subscriber carrier

--

The communications provider of the smart device.

Passcode or password setting

Si, SA#3, M

--

PasscodePresent

--

--

Whether a passcode or password is set on the smart device.

RAM (free)

SA, M, IS#5, IP#5

Hardware - RAM

A combination of the following items is displayed.

total_ram_size_bytes

free_ram_size_bytes

Hardware - Total physical memory

--

RAM

The total amount of RAM on the device

free

The amount of free RAM on the device.

Internal storage (free)

Si, SA, M, IS, IP

Hardware - Internal storage

A combination of the following items is displayed.

total_storage_size_bytes

free_storage_size_bytes

Displays a combination of the following items.

Hardware - Total storage space

Hardware - Free storage space

--

Internal storage

The amount of internal storage on the device.

free

The amount of free internal storage space.

External storage (free)

SA, M

Hardware - SD Card

A combination of the following items is displayed.

total_media_card_size_bytes

free_media_card_size_bytes

--

--

External storage

The total capacity of the external storage connected to the device.

free

The amount of free external storage space.

CPU Details

Processor

G

--

--

--

Devices > Chrome > Devices > "Serial number" > Hardware > Processor Model

Name of Processor is retrieved.

Memory Details

Capacity

SA, M, IS, IP, G

Hardware - RAM

total_ram_size_bytes

Hardware - Total physical memory

Devices > Chrome > Devices > "Serial number" > Hardware > Memory > Memory usage

The amount of memory.

Hard Disk Details

Capacity

Si, SA, M, IS, IP, G

Hardware - Internal storage

total_storage_size_bytes

Hardware - Total storage space

Devices > Chrome > Devices > "Serial number" > Hardware > Storage > Storage usage

The space of entire hard disk.

Software Inventory#4

Software Name

Si, SA, IS, IP

Software - Application name

--

Discovered apps - Application name

--

The software name of the installed software is collected.

Version

Si, SA, IS, IP

Software - Version

--

Discovered apps - Application version

--

The version of the installed software

Software Vendor

Si, SA

Software - Manufacturer

--

--

--

The manufacturer of the installed software

Microsoft Intune Information

Device ID

IP

--

--

Identifier for Device

--

The device ID in Microsoft Intune is obtained.

Last alive confirmation date/time

IP

--

--

Date/time the device last connects to Microsoft Intune

--

Date/time when the device last connected to Microsoft Intune is obtained in the local time of the web browser.

Last Capture Date/time

IP

--

--

The date and time when device information was last imported from Microsoft Intune to JP1/IT Desktop Management 2

--

The date and time when device information was last obtained from Microsoft Intune to the JP1/IT Desktop Management 2 - Manager is obtained in the local time of the web browser.

Legend:

Si: Can be collected when the system links with JP1/IT Desktop Management 2 - Smart Device Manager, and the OS of the smart device is iOS or iPadOS.

SA: Can be collected when the system links with JP1/IT Desktop Management 2 - Smart Device Manager, and the OS of the smart device is Android.

M: Can be collected when the system links with MobileIron.

IS: Can be acquired when linking with Microsoft Intune and device classification is "smart device".

IP: Can be acquired when linking with Microsoft Intune and the device classification is "PC".

G: Can be acquired when linking with Google Workspace and the OS type is Chrome OS.

--: Regardless of whether the device information can be collected, there is no corresponding item in the source MDM system.

#1: JP1/ITDM2 - SDM: JP1/IT Desktop Management 2 - Smart Device Manager

#2: When JP1/IT Desktop Management 2 - Smart Device Manager is 11-00-03 or a later version, Managed Smart Device List-Name is displayed as the smart device name by default. By changing the SDM_Mapping_Name property in the configuration file (jdn_manager_config.conf), you can display a combination of System Information-User, System Information-Phone Number, and Hardware-Model, with the items separated by colons (:). For details, see the description of how to change the processing settings in the configuration file in the JP1/ITDM2 - Manager Configuration Guide.

#3: This information can be acquired when JP1/IT Desktop Management 2 - Smart Device Manager is version 11-00-04 or later.

#4 : To collect the software information, you need to create the definition file sdm_import.properties, and then store it in JP1/IT-Desktop-Management-2-Manager-installation-folder\mgr\conf. For details about the definition file sdm_import.properties, see (3) Settings for collecting software information from an MDM system. This software information is displayed in the Software List view and Installed Software tab of the Inventory module, or the Managed Software view of the Assets module. Note that, in some cases, thousands of information items are collected, which might adversely affect viewabilty.

Tip

If the Agent is installed on a Managed device and the managed device is also managed by Microsoft Intune (combined management system), you can change the source of software information in the Intune_Import_Software_Source properties of the configuration file (jdn_manager_config.conf).

For more information about Intune_Import_Software_Source properties, see A.5 Lists of properties.

#5: Only the sum of RAM sizes can be acquired. The free space of RAM cannot be acquired.

You can also collect the information in the following table:

Device information item

Description

Management Type

MDM linkage management is set as the management type.

Device Status

Unknown is set if you collect smart device information from an MDM system, or re-register a wiped smart device.

Warning is set if the smart device was successfully wiped.

Management Status

Agent not Installed is set.

Last Alive Confirmation Date/Time

The date and time when the smart device connected to the MDM system is set.

See the following for details about device information:

(1) Types of device information you can collect

(2) Device status information that can be collected

(3) System information that can be collected

(4) Hardware information

(5) Installed software information

(6) Security information

(7) Shared management items for asset information and device information

(3) Settings for collecting software information from an MDM system

The following describes how to specify the definition file (sdm_import.properties) required to collect software information for smart devices.

To specify the definition file (sdm_import.properties):

Create a definition file (sdm_import.properties) that is coded in Key=Value format, and then store the file in the following location. Use UTF-8 character encoding to save the file.

JP1/IT-Desktop-Management-2-Manager-installation-folder\mgr\conf

The following table describes the information to be specified in the definition file (sdm_import.properties).

Key

Value details

Description

sdm.N.name

The name of the MDM setting that defines information about linkage with the MDM system (JP1/ITDM2 - SD Manager) from which to collect information.

Specify the same value specified in MDM settings name in the MDM Linkage Settings view that opens from General in the Settings module.

For N, specify a natural number. To specify multiple linkage settings to collect information, you can specify multiple keys, such as 1 and 2.

sdm.N.dbhost

The IP address or host name used to connect to the database of the JP1/ITDM2 - SDM#1 server.

Specify the IP address or host name#2 of a JP1/ITDM2 - SDM#1 server that can be connected within the same network segment as the computer on which JP1/IT Desktop Management 2 - Manager is installed.

For N, specify a natural number. To specify multiple linkage settings to collect information, you can specify multiple keys, such as 1 and 2.

sdm.N.dbport

The port number used to connect to the database of the JP1/ITDM2 - SDM#1 server.

Specify the port number#3 used to communicate with the database which is set up on the smart device manager of JP1/ITDM2 - SDM#1 server.

For N, specify a natural number. To specify multiple linkage settings to collect information, you can specify multiple keys, such as 1 and 2.

If omitted, the port number [26066] is used.

#1: JP1/ITDM2 - SDM: JP1/IT Desktop Management 2 - Smart Device Manager

#2: When specifying a host name, note the following:

Use 1 to 32 characters.

Specify the host name that is displayed by executing the hostname command.

Host names are case sensitive.

You cannot specify an alias of the host name.

The specified host name must be registered in the hosts file or DNS and resolved in advance.

To specify the host name in FQDN format, the host name must be defined in FQDN format in advance.

#3: If the smart device manager server of JP1/ITDM2 - SDM#1 controls the port number by using Windows Firewall, specify firewall settings to enable the designated port (send/receive both directions).

Example of specifying the definition file (sdm_import.properties)

The following shows an example of specifying the definition file when MDM linkage products have been registered with MDM setting names ITDM2 SD Manager 01 and ITDM2 SD Manager 02 .

sdm.1.name=ITDM2 SD Manager 01
sdm.1.dbhost=192.168.50.100
sdm.1.dbport=26066
sdm.2.name=ITDM2 SD Manager 02
sdm.2.dbhost=SDM-Server02
sdm.2.dbport=36066

(4) Notes on MDM linkage

Note the following when linking with an MDM system:

You cannot use underscores (_) in the host name of an MDM server.

The device information that can be collected by the MDM linkage function depends on the OS of the smart device and the MDM system from which the information is being collected. JP1/IT Desktop Management 2 only displays the items it was able to collect.

If you swap the SIM card in a smart device, the IMEI stays the same but the contract phone number changes. As a result, a situation might arise in which the device information does not match the IMEI, causing the device to be recognized as a new smart device.

If smart device information is collected from a MDM server via the proxy server, the connection between the management server and the MDM server may time out depending on the network environment or the number of smart devices. If required, change the timeout period on the proxy server.

When linking with an MDM system, you cannot lock, initialize and reset passcodes of smart devices that their profiles have been deleted. When any of the following operations are performed to smart devices that their profiles have been deleted from JP1/IT Desktop Management 2 - Manager, the operation fails. However, a message of the successful operation is output to the event, message, and audit logs.

[If linking with MobileIron 5.8 or later]

Initializing or resetting the passwords of smart devices that profiles have been deleted.

Do not delete profiles from managed smart devices.

If you use Google Workspace as your MDM system and delete a device enrolled in JP1/IT Desktop Management 2 in Google Workspace, it will not be automatically deleted from JP1/IT Desktop Management 2. If this happens, Change the Asset Status of the corresponding device from the Hardware Assets window of the assets window to Disposed and then delete Hardware Assets Information. For detail of action of Hardware Assets Information, see procedure for changing asset information and the procedure for deleting hardware asset information in the manual JP1/IT Desktop Management 2 Operation Guide.

When Microsoft Intune is used as MDM System, the device is assigned by Host Name of Agent Management device and device name (PC name) of the device imported from Microsoft Intune to identify Agent Management device and the device captured from Microsoft Intune. Set the PC name of the device to be unique.

If you are using MDM System with Microsoft Intune and you are regularly importing device inventory from Microsoft Intune, configure schedule to fetch from Microsoft Intune during nights or other periods when the volume of communication from Agent is relatively low. Depending on the environment, it takes about eight hours to capture 50,000 device inventories. If device inventory capture does not end at night, try to capture it during hours such as holidays.

If you are using MDM System with Google Workspace and you are regularly importing device inventory from Google Workspace, configure schedule to fetch from Google Workspace during nights or other periods when the volume of communication from Agent is relatively low. If device inventory capture does not end at night, try to capture it during hours such as holidays.

2.6.7 Auto maintenance of devices

This subsection describes auto maintenance that automatically deletes information about devices suggested for deletion based on the specified detection conditions for duplicate devices and idle devices. Here, duplicate devices are devices that have the same IP address, host name, MAC address, or BIOS serial number, and idle devices are devices that have not been used for a long time. If auto maintenance of devices is enabled, the presence of duplicate or idle devices is checked every day according to the specified conditions. All devices that match the conditions are listed as devices suggested for deletion (considered to be devices that do not require management), and are automatically deleted based on the schedule for automatic maintenance of devices when the scheduled date and time for automatic deletion is reached. This allows the system to automatically delete device information that is no longer required when new devices are added when, for example, devices are replaced, OSs are re-installed, or devices are discarded.

As an example of replacing devices by using the same IP address or host name before and after the replacement, the following describes the procedure for deleting device information that is no longer required during device maintenance.

On the management server, an administrator specifies detection conditions for duplicate devices.

Specify an IP address or host name for the duplication condition, and then enable the automatic deletion setting.

Tip

To manually delete device information that is no longer required, disable the automatic deletion setting.

A computer user replaces devices without uninstalling the agent.

Specify the same IP address or host name as was used before replacement, and then install the agent.

In response to a notification from the agent, the management server registers the new devices after replacement.

At this time, if there are no more available licenses, the devices are placed in the discovered status.

The old devices used before replacement are deleted by automatic deletion of duplicate devices.

Tip

If the automatic deletion setting is disabled, the administrator refers to the notification of the presence of devices suggested for deletion (displayed in the Topic panel of the Home module) to check duplicate devices, and then deletes unnecessary old devices. Alternatively, if the devices need not be deleted, the administrator registers them as devices not subject to maintenance (devices for which maintenance is suppressed).

If there are available licenses when the notification from the agent is received, the devices in the discovered status change to the managed status.

To check the devices that have been deleted automatically, see the publishing log file JDNSTRCx.log (where x is a numeral from 1 through 9) for events or configuration changes output to the management server.

Note

Offline management devices are not subject to device maintenance.

Note

In a multi-server configuration, devices managed by management relay servers under the primary management server are not subject to device maintenance on the primary management server. However, these devices are subject to device maintenance on each management relay server (the device maintenance setting is required on each management relay server). If a device managed by a management relay server is deleted because of device maintenance, the management relay server notifies a higher management server that the device has been deleted. Note that information about the devices deleted during device maintenance is output to JDNSTRCx.log (where x is a numeral from 1 through 9) on each management server.

Note

When devices are deleted, system configuration information is also deleted in conjunction with deletion of the device information (at this time, the devices are also deleted from the host group and ID group). However, if devices are first deleted from the system configuration information, device information is not deleted automatically. In this case, you must delete the device information manually.

Tip

A list of devices suggested for deletion appears in the lower part of the Device Maintenance Settings and Detection Results view that opens from Inventory of the Settings module.

Tip

When deleting devices, you can dispose of hardware resources in conjunction with the deletion of device information.

Tip

If automatic deletion of both duplicate devices and idle devices is enabled, duplicate devices are deleted before idle devices.

Tip

To assign software licenses to devices that are added because of replacement of devices or re-installation of the OS, use Move Software Licenses.

Note on deleting device information for the first time because of device maintenance

Use the following procedure:

Disable automatic deletion of duplicate devices and idle devices to prevent device information from being deleted automatically by mistake, contrary to the expectation of the administrator.

In the Device Maintenance Settings and Detection Results view that opens from Inventory of the Settings module, click the Start Detection button to manually detect devices suggested for deletion. Then, determine whether to exclude the devices as targets of maintenance or delete them.

Defining duplicate devices

By specifying the duplication conditions (the items below) and the number of days since the last connection, you can define duplicate devices that can be suggested for deletion. The devices that match the specified duplication condition are determined to be duplicate devices. Then, the devices whose last alive confirmation date and time is not the most recent and that have not connected to the management server for a period longer than the specified number of days are determined to be duplicate devices suggested for deletion. If multiple duplication conditions are specified, they are applied as AND conditions. Devices for which the following items are not specified (or for which an invalid value is specified) are not handled as duplicate devices.

IP address

If the device has multiple IP addresses, the representative IP address used for connection with the management server is the search target.

Host name

You can select whether host names are case sensitive.

MAC address

If the device has multiple MAC addresses, the representative MAC address used for connection with the management server is the search target.

BIOS serial number

If a MAC address and a BIOS serial number are specified as duplication conditions, AND conditions are assumed. Therefore, a device without a BIOS serial number specified cannot be determined to be a duplicate device.

Specifying the idle device definition

Devices that have not been connected to the management server for the specified number of days since the last connection are determined to be idle devices suggested for deletion.

Detection conditions for devices suggested for deletion

The following tables show whether detection conditions can be selected (are applicable) for device types, management modes, and management statuses.

Device type

Duplicate Devices

Idle Devices

Agent for Windows or Mac

Y

Y

Agent for UNIX

Y

Y

Agentless device

Y

Y

Smart device

Y

Y

Device for which the network monitor is enabled or being enabled

N

N

Relay system

N

N

Management relay server

N

N

API-controlled devices

Y

Y

Legend: Y: Can be selected (applicable). N: Cannot be selected (not applicable).

Management mode

Duplicate Devices

Idle Devices

Online management

Y (fixed)

Y (fixed)

Offline management

N

N

Legend: Y: Can be selected (applicable). N: Cannot be selected (not applicable).

Management status

Duplicate Devices

Idle Devices

Managed device

Y (fixed)

Y (fixed)

Discovered device

Y (fixed)

Y (fixed)

Excluded device

N

N

Legend: Y: Can be selected (applicable). N: Cannot be selected (not applicable).

The following table shows examples of conditions specified for detecting duplicate devices.

Maintenance trigger

Duplication conditions

Agent installed

Agentless

Smart device

API

Windows or Mac OS

UNIX

Replacement of devices

IP address

IP address and host name

IP address

Host name #1

IP address and host name

HDD failure, re-creation of a host identifier, or replacement of the OS

BIOS serial number or MAC address

MAC address

IP address

--

BIOS serial number, MAC address, and IP address

Re-registration of a smart device (JP1/ITDM2 - SDM#2)

--

--

--

Host name #3

--

Legend: --: Not supported

#1: In the case of MobileIron. Note, however, that this cannot be used for Wi-Fi terminals.

#2: JP1/ITDM2 - SDM: JP1/IT Desktop Management 2 - Smart Device Manager

#3: Cannot be used for Wi-Fi terminals.

Specifying devices not subject to maintenance (devices for which maintenance is suppressed)

Devices that do not access the management server for a long time because of, for example, a long-term business trip or a cluster environment can be explicitly specified as devices not subject to maintenance. The registered devices not subject to maintenance are handled as follows:

Even if the devices meet the specified detection condition, they are not counted as devices suggested for deletion.

The devices are not deleted by automatic deletion of devices suggested for deletion.

Specifying automatic deletion of devices suggested for deletion

You can specify that devices suggested for deletion are to be automatically deleted. At this time, you can also specify the period until deletion. During this period, the administrator can check and specify which devices are not subject to maintenance (devices for which maintenance is suppressed). You can specify automatic deletion for the duplicate device definition and the idle device definition individually.

If automatic deletion is enabled, the processing is as follows:

Duplicate Devices

Among duplicate devices suggested for deletion, the devices that have not connected to the management server for longer than the specified period (Period Until Automatic Deletion plus Time Since Last Connected in the duplicate device definition) are deleted automatically.

Idle Devices

Among idle devices suggested for deletion, the devices that have not connected to the management server for longer than the specified period (Period Until Automatic Deletion plus Time Since Last Connected in the idle device definition) are deleted automatically.

Schedule of auto maintenance of devices

The scheduled auto maintenance of devices (for both duplicate devices and idle devices) is performed according to the value specified in the DeviceAutoMaintenanceTime property of the configuration file (jdn_manager_config.conf). For details about the DeviceAutoMaintenanceTime property, see the description of the procedure for using configuration files to configure processing in the JP1/IT Desktop Management 2 Configuration Guide.

Relationship between device maintenance and system configuration information maintenance

If devices are deleted during device maintenance, the system configuration information corresponding to the deleted devices is also deleted automatically. The devices are also deleted from the host group and ID group. In this case, information about the deleted computers is output to JDNSTRCx.log (where x is a numeral from 1 through 9), rather than to the log file CLTDELn.LOG (where n is a numeral from 1 through 4).

Note that the system configuration information corresponding to a deleted device is automatically deleted when you delete the device by one of the following operations or by some other operation:

In List of Devices Suggested for Deletion displayed in the Device Maintenance Settings and Detection Results view (under Inventory) of the Settings module, select the target devices, and then click Remove Device Inventory in the Action menu.

In Managed Nodes displayed in the Managed Nodes view (under Discovery) of the Settings module, select the target devices, and then click Remove in the Action menu.

Deletion of the system configuration information corresponding to the device deletion is applied to the agents managed by the local server. The relay systems are not deleted automatically. When you delete the relay systems from the list of devices, also delete the relay systems from the system configuration information using the Remote Install Manager.

Note

Even if the host deleted from the system configuration information remains as a destination in a job definition, the destination is not deleted.

Tip

The following describes the recovery procedure when the following message text is output to the MAIN.LOG file on the agent machine.

Message text output to MAIN.LOG

System configuration information could not be registered correctly because internal file information was invalid. Maintenance information = maintenance-information

The message text above indicates that the addition, update, or deletion of system configuration information could not be notified normally. Use the following recovery procedure to register the system configuration information again:

Delete the following file:

JP1/IT Desktop Management 2 installation directory\CLIENT\SYSENT\SYSINFBK

Restart the agent computer.

In the system configuration attribute tab, confirm that the update date and time have been updated.

Note that if the addition, update, or deletion of system configuration information could not be notified normally, unnecessary host information might remain. In this case, delete the host information from the system configuration.

2.6.8 Registering device information by using the API

You can register device information in JP1/IT Desktop Management 2 from an external system.

An external system makes devices its management targets by using the API provided by JP1/IT Desktop Management 2. This allows JP1/IT Desktop Management 2 to collect device information from the external system.

The control of devices by using the API is referred to as API control. Devices managed through the API, on the other hand, are referred to as the API-controlled devices.

For example, by retrieving information regarding purchased devices from a procurement system and incorporating it into JP1/IT Desktop Management 2, you can create an asset ledger without an agent or summarize information linked to purchased devices.

Furthermore, by registering information regarding operational technology devices (hereafter, OT devices) in JP1/IT Desktop Management 2 from the external system managing the OT devices, you can create an asset ledger for OT devices and check for the existence of OT devices without the need to install agents.

2.7 Controlling devices remotely

With the rapid advance in information technology in recent years, users who are not equipped to set up applications or troubleshoot problems are increasingly common. To handle their computer problems, organizations typically rely on a system administrator with specialist knowledge. If workplaces are dispersed, it becomes difficult to respond in a timely manner.

By using the remote control feature, an administrator can remotely operate a computer where a problem has occurred from his or her own computer, dealing with problems quicklythrough actions such as sharing operating procedures and sending and receiving data.

2.7.1 Process for remotely controlling devices

This section describes the workings of the remote control feature provided by JP1/IT Desktop Management 2.

The remote control feature allows an administrator to connect to a remote computer and control its GUI using keyboard and mouse operations.

The controller program must be installed on the administrator's computer to invoke a remote computer's GUI. You can install the controller program by starting the remote control feature from the JP1/IT Desktop Management 2 operation window. If the controller is not installed on the computer you are using, the program is automatically downloaded and installed.

Tip

You can then start the controller directly on the computer, allowing you to start a remote control session quickly without needing to log in to the operations window.

You initiate a remote control session by using the controller to connect to the remote computer. There are two ways the controller can connect to a remote computer:

Standard connection

A method of connecting to a computer using the remote control feature provided by JP1/IT Desktop Management 2. In this method, a remote control session is established between the controller and the remote control agent component of the agent. Due to its faster speeds and the fact that all remote control functions become available when a standard connection is used, we recommend that you use this method where possible. To use a standard connection, the agent program must be installed on the computer you are controlling.

RFB connection

A method of connecting to a computer using the RFB protocol. In this method, a remote control session is established using AMT or VNC server software. Use this method to remotely control computers where you cannot log on to Windows, and agentless computers running Linux or Mac OS. Note that limited functionality is available in a remote control session that uses an RFB connection.

To use an RFB connection, the computer you are controlling must support connections using the RFB protocol.

You can select the connection method when connecting to the remote computer from the controller. If you do not select a connection method, a standard connection is used. If the controller cannot establish a standard connection, it will use an RFB connection.

When you select a connection-target computer in the operations window and start the remote control feature, the controller program starts and automatically connects to the computer. If you started the controller program directly, you can specify a connection target in the controller interface.

If the connection is successful, the user interface of the remote computer appears in the controller. You can then use the remote control function to operate the remote computer.

Related Topics:

4.3.3 Prerequisites for remote control

2.7.2 Remote control features

2.7.3 Functional differences between remote control connection methods

2.7.2 Remote control features

The remote control feature of JP1/IT Desktop Management 2 provides the following functionality:

Remote control of computers

You can control a remote computer as if you were seated in front of it. If an unforeseen problem occurs on a user's computer, an administrator can take action such as investigating the cause of the problem and restarting the computer, without having to travel to its location. For details about how to remotely control a computer, see 2.7.14 Controlling the interface of a computer during a remote control session.

File transfers

You can send and receive files to and from computers you are controlling remotely. Because you can browse the contents of the remote computer's hard disk in the same way as you browse a local disk in Explorer, you can easily find and transfer the files you need without setting up file sharing or installing special software. For details about how to transfer files, see 2.7.15 Transferring files during remote control sessions.

Management of connection targets

You can create a list of the computers that you connect to frequently, and manage the list separately from the JP1/IT Desktop Management 2 modules. You can also search the network for computers you can control remotely. For details about how to manage connection targets, see 2.7.17 Managing connection targets for the remote control feature.

Sending a connection request to the controller

If your network is configured in a way that prevents the controller from connecting to a computer directly, you can start a remote control session by having the user send a connection request to the controller from his or her computer. For details about how to send a connection request from a computer to a controller, see 2.7.16 Issuing connection requests from remote computers to controllers.

Record and play back remote control sessions

You can record the screen activity during a remote control session, and convert the recorded data to a video file to be used for user training or to give troubleshooting advice. For details about how to record and play back remote control sessions, see 2.7.18 Recording and playback of remote control sessions.

Chat

You can chat with several users at once. Use this feature when you want to issue instructions to multiple users, or communicate with users who you cannot contact by telephone. For details about how to use the chat feature, see 2.7.19 Using the chat feature.

Related Topics:

4.3.3 Prerequisites for remote control

2.7.3 Functional differences between remote control connection methods

There are some differences in remote control capabilities depending on the connection method and the computer environment. The following table describes functional differences by connection method:

Feature

Description

Available

Standard

RFB

Controller features

Connection to a remote computer

Lets you connect to a remote computer.

Y

Y

Use of authentication information

Uses authentication information when connecting to a remote computer.

Y

Y

Connection mode

Restricts the operations available to the users of the controller and the remote computer during a remote control session.

Y

Y*

Connection status display

Displays the status of the connection to the remote computer.

Y

Y

Remote desktop display

Reproduces the user interface of the remote computer in the controller program.

Y

Y

Keyboard and mouse operations

Lets you use keyboard and mouse commands to interact with the remote computer.

Y

Y

Clipboard

Synchronizes your clipboard contents with those of the remote computer.

Y

Y*

Terminate remote control session

Disconnects from a remote computer and terminate the remote control session.

Y

Y

Power control

Controls the power status of the remote computer.

Y

Y*

Remote CD-ROM

Makes a CD/DVD drive on the controller (a drive with the device type CD-ROM) available to the remote computer.

Y*

Y*

Recording, playback, and format conversion of remote control sessions

Records the screen activity during a remote control session, and plays it back as a video file.

Converts video files to AVI files.

Y

Y

Controller environment setup

Customizes the configuration of the controller.

Y

Y

Connection target management

Manage connection lists

Manages connection-destination computers independently of the JP1/IT Desktop Management 2 modules.

Y

Y

Search for computers

Searches the network for potential connection targets.

Y

Y

Receive connection requests from remote computers

Initiates a remote control session in response to a connection request received by the controller from a remote computer.

Y

N

Remote control agent

Confirm connection

Lets users choose to accept or reject connection requests from the controller.

Y

N

Check connection mode

Checks which connection mode is being used.

Y

N

Check connection status

Lets the user of the remote computer check the status of the connection with the controller.

Y

N

Disconnect

Lets users disconnect from the controller.

Y

N

Hide user interface

Hides or locks the screen of the remote computer during a remote control session.

Y

N

Configure the remote control agent environment

Customizes the configuration of the remote control agent.

Y

N

File transfer

View file lists

Displays the hard drive contents of the controller and the remote computer.

Y

N

Edit file properties

Lets you edit the properties of files on the controller and the remote computer.

Y

N

Edit files

Lets you edit files on the controller and the remote computer.

Y

N

Transfer files

Transfers files between the controller and the remote computer.

Y

N

Customized transfer

Transfers files to several computers at once.

Y

N

manage transfer information

Automatically downloads and caches files opened on a remote computer.

Y

N

Chat

Chat server

Initiates chat sessions in response to requests received from other computers.

Y

N

Chat client

Allows you to connect to a chat server and participate in a chat session.

Y

N

Chat log

Keeps a record of the contents of a chat session.

Y

N

Print logs

Prints the contents of a chat log.

Y

N

Initiate remote control session

Initiates a remote control session with a computer involved in a chat session.

Y

N

Operation window linkage

Controller installation

Automatically downloads and installs the controller program on computers without the controller installed.

Y

Y

Automatic controller update

Automatically updates the controller program on computers with the controller installed.

Y

Y

Launch and connect to a computer

Starts the controller program and connects to a computer you select in the operation window.

Y

Y

Link with other programs

Connects to a remote computer by calling the controller from another program using a command.

Y

Y

VNC server connection

Remotely controls a computer using software with VNC server functionality.

N

Y

BIOS configuration

Lets you display and configure the BIOS of a remote computer.

N

Y

Legend: Y: Available. Y*: Functionality is limited or depends on computer environment. N: Not available.

2.7.4 Notes on using the remote control feature in multi-language environments

If the controller and the remote computer use different keyboard types, key entry might not work as intended.

2.7.5 Notes on files generated by the controller in user environments

The following files associated with the controller program increase in number over time. We recommend that you delete the files before the disk space they occupy becomes an issue.

Temporary files used in file transfer

If you clear the Delete local copy on the controller check box on the Files tab of the Environment Settings dialog box displayed from the File Transfer window, the temporary files are not automatically removed from the controller system. The files remain in the storage folder for file transfers specified on the Files tab of the Environment Settings dialog box.

Video files

The files containing video recordings of remote control sessions are not deleted automatically. The files are created in a location chosen by the user, and their size depends on the length of the recording.

2.7.6 Automatically updating the controller program

When the controller program is updated as part of an JP1/IT Desktop Management 2 upgrade, the controller program is automatically replaced with the new version the next time you start a remote control session from the operation window.

Important

In the following situations, the controller program is not automatically replaced:

In an environment where you connect to JP1/IT Desktop Management 2 via a proxy server, the proxy server is configured incorrectly in the Internet Options

Internet Explorer is in offline mode

2.7.7 Setting a connection mode for remote control sessions

You can limit the operations available during a remote control session by specifying a connection mode. This allows you to impose restrictions such as preventing users from using the remotely controlled computer during the remote control session, or limiting the administrator to viewing the user interface in the controller program.

There are three connection modes: Exclusive, Shared, and View. Each mode is described below.

Exclusive

In this mode, only the controller side can control the computer. The user cannot use his or her keyboard or mouse to control the computer. Use this mode if you want to prevent the user from using his or her computer while the controller side is controlling the computer. If you select Exclusive mode and then connect using RFB, the mode automatically goes into Shared mode.

Important

You cannot use Exclusive mode over an RFB connection.

Shared

In this mode, the administrator using the controller program and the user of the remote computer are both able to control the computer. Connect using this mode when the administrator and the user might both need to operate the computer.

View

In this mode, you can view the screen of the remote computer, but not control it using keyboard or mouse operations. Connect using this mode when you just want to view the activity taking place on the remote computer.

Determining the connection mode

The connection mode is determined from the combination of controller settings and agent configurations. The following table shows combinations of the selected connection mode and the mode name displayed on the status window of the remote control agent.

Agent configuration

Setting in the controller

Exclusive

Shared

View

Exclusive

Pattern 1

Controller: View

Agent: Exclusive

Pattern 2

Controller: View

Agent: Exclusive

Pattern 2

Controller: View

Agent: Exclusive

Shared

Pattern 3

Controller: Exclusive

Agent: View

Pattern 1

Controller: Shared

Agent: Shared

Pattern 2

Controller: View

Agent: Shared

View

Pattern 3

Controller: Exclusive

Agent: View

Pattern 3

Controller: Shared

Agent: View

Pattern 1

Controller: View

Agent: View

The following describes Patterns 1 through 3 in the table above.

Patterns 1 and 2

If both the agent and controller are set to the same remote control mode (Pattern 1) and when the agent has a higher-level mode (Pattern 2), the agent configuration takes precedence. Therefore, if the agent is set to Exclusive mode, the controller will go into View mode regardless of the controller's own setting. If the agent is set to Shared or View mode, the controller will use its own setting.

Pattern 3

If the controller has a higher-level mode (Pattern 3), the controller setting takes precedence. Therefore, if the controller is set to Exclusive mode, the agent will go into View mode regardless of the agent's own setting. If the controller is set to Shared mode, the agent will use its own setting.

(1) Changing the connection mode from a remotely controlled computer

A user cannot use his or her computer if it is being remotely controlled in exclusive mode.

If a need arises for the user to control the computer, he or she can change the connection mode to shared by pressing Ctrl + Alt + Delete.

When a user uses this method to change the connection mode from exclusive to shared, the controller is notified and displays a message asking whether the administrator wants to allow it. If the administrator does not permit the mode change, the computer reverts to exclusive mode and the user is unable to operate the computer again.

Tip

The connection mode changes to shared as soon as the user presses Ctrl + Alt + Delete on his or her computer. This means that by the time the message appears in the controller, the connection has already entered shared mode.

(2) Connection modes when using multiple remote control connections

When several controllers connect to one computer, only one of those controllers can work in exclusive mode. All other controllers work in view mode.

If the controller working in exclusive mode changes to another mode or leaves the session, a message appears on the other controllers indicating that the session is no longer in exclusive mode.

The following figures show examples of how the connection mode changes when you use multiple remote control connections.

Example 1: Initial state

Suppose that three controllers connect to a single remote computer using the connection modes illustrated below.

Example 2: Controller 1 changes to exclusive mode

When controller 1 changes to exclusive mode from its initial state, the connection modes of the other controllers change as shown below.

Controller 1 changes to exclusive mode.

A message reporting the change appears on the remote computer.

The user clicks OK on the remote computer.

The remote computer enters view mode. A message indicating that another controller has entered exclusive mode appears on controller 2.

The administrator clicks OK in controller 2.

Controller 2 enters view mode.

Example 3: Controller 1 changes to another mode from exclusive mode

From the state in example 2, if controller 1 changes to another mode from exclusive mode, the other controllers do not change mode. The result is the same if controller 1 disconnects from the remote computer.

Controller 1 changes to shared mode.

A message appears in controller 2 and controller 3 indicating that controller 1 is no longer in exclusive mode. However, controller 2 remains in view mode.

Example 4: The user presses Ctrl + Alt + Delete on the remote computer after controller 1 has entered exclusive mode.

In the state in example 2, if the user of the remote computer presses Ctrl + Alt + Delete, the connection modes of the other controllers change as follows:

The user presses Ctrl + Alt + Delete on the remote computer.

A message requesting confirmation of the change of connection mode appears in controller 1.

The administrator clicks Yes in controller 1.

Controller 1 and the remote computer enter shared mode. If the user clicks No instead, the mode does not change.

In controller 2 and 3, a message appears indicating that the other controller is no longer in exclusive mode. Controller 2 and 3 remain in view mode.

(3) Checking controller connection status

You can check the following information from the status window or from the Remote Control Agent icon that appears when the remote control agent starts:

Whether any controllers are connected

How many controllers are connected

The Agent connection mode

Remote Control Agent icon displays

The Remote Control Agent icon is color-coded as follows to indicate controller connection status:

Gray: Not connected

Orange: Connected in view mode

Yellow: Connected in shared mode

Green: Connected in exclusive mode

When you position the mouse pointer on the Remote Control Agent icon, the number of connected controllers appears.

Display in the status window

The color of the title bar of the status window shows controller connection status. The color coding is the same as for the Remote Control Agent icon. The connection status, connection mode, and number of connected controllers are shown in the title bar.

The number in parentheses in the title bar is the number of connected controllers.

2.7.8 Displaying the connection status of remote control sessions

When you connect to a remote computer, information about the remote control session appears in the status bar of the controller program. This information is described in the following table.

Item

Description

Shown by default

Bytes sent

The number of bytes sent. You can change the display format or reset the number from the pop-up menu displayed when you right-click the item.

N

Bytes received

The number of bytes received. You can change the display format or reset the number from the pop-up menu displayed when you right-click the item.

N

Time elapsed

The length of time since the connection to the remote computer was established.

You can reset the time from the pop-up menu displayed when you right-click the item.

N

Remote CD-ROM status

The status of the remote CD-ROM (or DVD-ROM).

You can permit or deny remote access to the CD-ROM (or DVD-ROM) drive from the pop-up menu displayed when you right-click the item.

Y#

Recording status

An icon showing whether the remote control session is being recorded.

You can start, stop, and pause a recording from the pop-up menu displayed when you right-click the icon.

N

Transmission status

Shows how much data was sent and received and the encryption status.

You can reset the numbers from the pop-up menu displayed when you right-click the item.

A

Protocol

Shows the protocol (HRC or RFB) used for the connection.

A

Connection mode

Shows the connection mode of the controller.

You can change the connection mode from the pop-up menu displayed when you right-click the item.

Y

Legend: Y: Displayed by default. A: Displayed while a connection is active. N: Not displayed.

#: Always displayed when using an RFB connection.

You can show or hide the following items by selecting the Status bar command in the View menu of the Remote Control window:

Elapsed time

Bytes sent and received

2.7.9 Using the remote control feature in NAT and DHCP environments

In NAT environments

NAT is a process of translating network addresses to mask a private address space from the public network. There are two types of address translation: Fixed address allocation (static mode) and dynamic address allocation (dynamic mode).

Note the following when using the remote control feature in a NAT environment:

When using fixed address allocation (static mode)

No restrictions apply to use of the remote control feature.

When using dynamic address allocation (dynamic mode)

You cannot connect to a computer from the controller. You can initiate a remote control session by having the user send a connection request from the computer to the controller.

In DHCP environments

DHCP is a network protocol that automatically allocates IP addresses to computers as they connect to the network. Because computers in a DHCP environment have a different IP address each time they connect to the network, you cannot connect to a computer from the controller. You can initiate a remote control session by sending a connection request from the computer to the controller.

Note that if you use static DHCP, computers retain the same IP address, allowing you to connect to computers directly from the controller.

Related Topics:

2.7.16 Issuing connection requests from remote computers to controllers

2.7.10 User permissions required for remote control using Windows authentication

If you enable Windows authentication in the authentication information settings of the remote control agent, you must have the appropriate user permissions to access the remote computer over the network. User permission settings are a Windows feature. The following table shows the user permissions required for each OS situation.

Operating system usage

Required permission

Local computer

Administrators permission or other appropriate privileges. If the computer belongs to a domain, you must have Domain Admins group permission.

A workstation or server that belongs to a domain

Active Directory Domain Admins group, Enterprise Admins group, or other appropriate privileges.

Domain controller or workstation with the Windows Server 2003 Administrative Tools Pack installed

Domain controller

Note: For added security, consider logging on as a non-administrator user and elevating your account to administrator privileges when setting security information.

2.7.11 Setting user permissions required for remote control using Windows autpagehentication

This section describes how to set the user permissions for each OS situation.

Tip

The procedures explained here all involve changing settings in the Windows operating system. The specific procedures and on-screen labels might differ depending on the specific version of Windows you are using.

To set user permissions on a local computer:

In the Control Panel, select Administrative Tools.

Double-click Local Security Policy.

In the console tree, click Security Settings.

Under Local Policies, select User Rights Assignment.

In the right pane, double-click Access this computer from the network or Deny access to this computer from the network.

Set the user permissions in the dialog box that appears.

To set user permissions on a workstation or server in a domain:

In the Windows Start menu, select Run.

Enter mmc and click OK.

From the File menu of the Console, select Add/Remove Snap-in.

In the Available snap-ins list, select Group Policy Object Editor and then click Add.

In the Select Group Policy Object dialog box, click Browse.

Select the group policy object that you want to change.

After completing the settings, click the Complete or OK button to close the Add or Remove Snap-ins dialog box.

In the console tree, under Group Policy Object, select computer-name Policy, Computer Configuration, Windows Settings, and then Security Settings.

Under Local Policies, select User Rights Assignment.

In the right pane, double-click Access this computer from the network or Deny access to this computer from the network.

Set the user permissions in the dialog box that appears. If there is no security setting defined for the policy, select the Define this policy setting check box.

To set user permissions on a domain controller or workstation with the Windows Server 2003 Administrative Tools Pack installed:

From the Windows Start menu, open the Control Panel and select Administrative Tools.

Double-click Active Directory Users and Computers.

In the console tree, double-click the group policy object whose security settings you want to edit.

Click Properties and display the Group Policy tab.

To edit an existing group policy object, select Edit.

To create a new group policy object, click New and then Edit.

In the console tree, under Group Policy Object, select computer-name Policy, Computer Configuration, Windows Settings, and then Security Settings.

Under Local Policies, select User Rights Assignment.

In the right pane, double-click Access this computer from the network or Deny access to this computer from the network.

Set the user permissions in the dialog box that appears. If there is no security setting defined for the policy, select the Define this policy setting check box.

To set user permissions on a domain controller:

From the Windows Start menu, open the Control Panel and select Administrative Tools.

Double-click Domain Controller Security Policy.

In the console tree, under Group Policy Object, select computer-name Policy, Computer Configuration, Windows Settings, and then Security Settings.

Under Local Policies, select User Rights Assignment.

In the right pane, double-click Access this computer from the network or Deny access to this computer from the network.

Set the user permissions in the dialog box. If there is no security setting defined for the policy, select the Define this policy setting check box.

2.7.12 Setting authentication information for remote control

You can set user-level authentication information for connections made from controllers to computers with the agent installed. Set authentication information when you want to permit specific administrators to participate in remote control sessions. If you do not set any authentication information, connections are permitted from all administrators.

There are two types of user authentication you can use when setting authentication information:

Standard authentication

User authentication provided by JP1/IT Desktop Management 2. Only an administrator with the user name and password set in the authentication information can connect to a remote computer.

Windows authentication

User authentication implemented by linking with Windows authentication. Only the Windows users and groups set in the authentication information can connect to a remote computer. This approach allows you to apply detailed security policies that define password expiry dates, auditing, and other security measures. When you perform authentication with a domain user, add the setting in the following format: "User name@domain name", or "Domain name\user name".

You can register and manage authentication information for multiple administrators. You can then assign shared mode or exclusive mode to specific administrators, or limit the operations the administrator is able to perform in a remote control session. For example, you might want to prevent an administrator from shutting down a remote computer. You can further enhance the security of remote control sessions by linking user authentication with Windows authentication.

You can define authentication information in the agent configurations.

2.7.13 Connecting from a controller to a remote computer

If you start the controller program directly or the connection to a remote computer is lost, you need to specify the connection destination in the controller to connect to the remote computer. You can specify a connection destination by:

Directly specifying a host name or IP address

Selecting a computer from a list

Connecting to a computer listed in the connection log

Searching for a connection-target computer

If authentication information is set on the remote computer, a dialog box asking for your credentials appears when you attempt to establish a connection, regardless of the method you use. Enter the authentication information set in the User Authentication area under Remote Control Settings in the agent configurations, or the authentication information set on the connection-target VNC server. In the default agent configuration, the user ID is system and the password is manager.

If the remote control feature is configured to display connection requests on the remote computer, and the user rejects the request, a message reporting this fact appears in the controller.

Tip

A maximum of 255 controllers can connect to a single remote computer.

Tip

If access to the remote computer is denied or the connection times out, the system attempts to connect again using RFB. Note that if the controller is configured to turn on a remote computer, and the RFB reconnection fails (times out) because the computer is turned off, the remote control feature uses Wake on LAN and AMT to start the remote computer before attempting to connect again.

Related Topics:

2.7.17 Managing connection targets for the remote control feature

(1) Remote control operations at the user side

The remote control agent is part of an agent program that allows remote control on the user computer. Usually no operations are required on the remotely controlled side, but if necessary the user can deny connection or check remote connection status. The remote control agent can issue connection requests to controllers as well as waiting for connections from controllers.

From Remote Control Settings in the Agent Configurations view, you can set up the remote control agent to start automatically. The remote control agent will then start automatically whenever any computer on which it is installed is started.

If automatic startup is not specified, you will need to ask the user to start the remote control agent manually. To start the remote control agent manually, from the Windows Start menu, select All Programs, JP1_IT Desktop Management 2 - Agent, Remote Control Agent, and then Remote Control Agent.

When Remote Control Agent starts, the Remote Control Agent icon () appears in the task bar.

If you did set up the agent configuration for status icon display, the Remote Control Agent icon and status window will not appear when the remote control agent is active.

Tip

The Remote Control Agent icon () indicates that no controllers are connected. When a controller connects with the remote computer, the icon changes according to the connection mode.

Tip

The Remote Control Agent icon does not appear in the task bar in Windows 7 or Windows Server 2008 R2. If you want to display the icon, from the Control Panel select Customizing the desktop and then Customizing the taskbar icon. Set Show icon and notifications for the Remote Control Agent icon.

2.7.14 Controlling the interface of a computer during a remote control session

When using the remote control feature to operate a remote computer, the controller can perform the following operations on the computer it controls:

Keyboard and mouse operations

You can use keyboard and mouse operations, such as entering text and dragging icons, to control the user interface of the remote computer as you do on your own PC. You can also use shortcuts like Ctrl + C by registering them as special keys.

Use of CD-ROM and DVD-ROM drives

You can make the controller's CD and DVD drives (drives with the drive type CD-ROM) available on the remote computer. This allows you to install software without having to transfer the data first.

Shutdown and restart

From the controller, you can direct a remote computer to shut down or restart. If you configure the controller to reconnect after the remote computer restarts, it will automatically reconnect allowing you to continue the remote control session.

Clipboard sharing

You can send and receive clipboard data between the controller and the remote computer. This allows you to copy and paste text and bitmap data between the controller, and the computer being controlled.

Tip

The controller can control computers in a multi-display environment.

Related Topics:

(1) Registering and entering special keys for use in remote control sessions

(3) Transferring clipboard data during remote control sessions

(1) Registering and entering special keys for use in remote control sessions

When you use your keyboard to enter special keys like function keys and keyboard shortcuts, those keystrokes apply to the controller itself. To use special keys on the remote computer, you need to register them in the controller first. Fore details about registering special keys in the controller, see the description of registering a special key with the controller in the manual JP1/IT Desktop Management 2 Administration Guide.

The special keys you register appear in the key input bar of the Remote Control window. By clicking the buttons in the key input bar, you can enter the associated special key in the remote computer.

Tip

If the controller computer and the remote computer have different input environments (for example, the controller system uses an English-language keyboard while the remote system uses a Japanese layout), you might not be able to enter certain characters using your keyboard. In this case, you can enter such characters without needing to be conscious of the different input environments by using special keys or transferring the data using the clipboard.

Related Topics:

(2) Default special keys registered in the controller

(3) Transferring clipboard data during remote control sessions

(2) Default special keys registered in the controller

The following table lists the special keys provided by default in the controller program. You can add a default special key by selecting the Default option under Action key type when you register a special key.

No.

Special keys

1

F1

2

Shift + F1

3

Shift + F10

4

SpaceBar

5

Esc

6

Alt

7

Alt + Tab

8

Alt + Esc

9

Alt + SpaceBar

10

Alt + -

11

Alt + Enter

12

Alt + F4

13

Alt + F6

14

Alt + PrintScreen

15

PrintScreen

16

Ctrl + C

17

Ctrl + O

18

Ctrl + P

19

Ctrl + S

20

Ctrl + V

21

Ctrl + X

22

Ctrl + Z

23

Ctrl + Esc

24

Ctrl + F6

25

Ctrl + Tab

26

Kanji

(3) Transferring clipboard data during remote control sessions

You can configure the remote control feature to automatically transfer clipboard data from the controller to the remote computer, or vice versa, each time the clipboard contents change. This ensures that the clipboard contents are always the same on both computers, which means you can work seamlessly between them when performing operations like the following:

Displaying a Web site in a Web browser on the remote computer by pasting a URL recorded on the controller PC

Paste screenshots or other data collected on the remote computer into documents being created on the controller computer

There are some differences in the types of data that can be transferred depending on the connection type.

For standard connections:

You can transfer the following types of data or any combination thereof:

Text

Bitmaps

Metafiles

Rich text

Color palettes

For RFB connections:

You can send and receive ASCII text only. The ability to send and receive non-ASCII text depends on the environment of the remote computer.

Clipboard data is transferred when the controller window becomes active. If you are using an RFB connection, data is transferred when the clipboard contents are updated on the remote computer.

Tip

When using a standard connection, to prevent the system from slowing down when a large amount of data is copied to the clipboard, you can configure the remote control feature to only transfer text on the Optimize Transaction tab of the Environment Settings dialog box.

Tip

While clipboard data is being transferred, the system displays a message and progress bar in the status bar at the bottom of the Remote Control window. If you start transferring an unexpectedly large file that appears to be taking too long to transfer, you can cancel the transmission by right-clicking the progress bar and selecting Cancel. The data being transferred is discarded, and the clipboard reverts to its previous contents.

(4) Setting search ranges for connection-target computers

There are five ways to set the search range for connection-target computers, as described in the table below.

No.

Method

Example

Actual search range

1

Specify a single IP address.

172.17.11.10

172.17.11.10

2

Enter the first three bytes of the IP address. As the last byte, enter two numbers joined by a hyphen (-). Use this format to search within a group of consecutive IP addresses.

172.17.11.10-20

172.17.11.10 to 172.17.11.20

3

Enter the first three bytes of the IP address. As the last byte, enter several numbers separated by commas (,). Use this format to search within a group of non-consecutive IP addresses.

172.17.11.10,11,100,200

172.17.11.10,172.17.11.11,172.17.11.100,172.17.11.200

4

Use a combination of methods 2 and 3.

172.17.11.10,50-100,200

172.17.11.10, 172.17.11.50 to 172.17.11.100, and 172.17.11.200

5

Specify the first three bytes of the IP address. Use this format to search among all the IP addresses within a given subnet.

172.17.11

172.17.11.0 to 172.17.11.255

(5) Status of connection-target computers

Computers in the Search Agents dialog box can be in Awaiting connection, Connection rejected, Not running, or Not responding status. The figure below shows how a computer transitions between these statuses.

Not responding

The computer does not exist or is turned off.

Not running

The computer cannot be controlled remotely, or the remote control agent is not running on the computer.

Connection rejected

The remote control agent is running on the computer (with the agent installed), but a connection cannot be established. Possible causes include the agent not being registered as a permitted controller, and the port used by the remote control feature being used by another application. Check the message on the Details tab of the Search Agents dialog box.

Awaiting connection

The computer is ready to accept connections.

(6) Operating the menu bar during a full-screen remote control session

In full screen mode, you can use the menu bar to, for example, define the remote control settings, view how much data has been sent and received, and change the display settings.

The following table shows the icons in the menu bar and describes their function.

Icon

Name

Description

Pin icon

Click this icon to keep the menu bar displayed at all times. After you click the pin button, the menu bar remains on screen regardless of where the mouse pointer is located. This feature is disabled by default.

Ctrl + Alt + Delete button

Clicking this icon has the same effect as pressing Ctrl + Alt + Delete on the remote computer.

Refresh button

Click this button to refresh the contents of the controller window. You can use this button to correct glitches in the display, for example.

Send/Receive icon

This icon shows whether data is being sent to and received from the remote computer, and whether the data is encrypted. Encryption is indicated by a key icon.

You can reset the values from the pop-up menu that appears when you right-click the icon.

Minimize button

Click this icon to minimize the controller window. The desktop of the computer running the controller appears.

Restore button

Click this icon to exit full-screen mode.

Close button

Click this icon to end the remote control session and close the window.

(7) Notes on using the remote control feature

This section provides cautionary notes that apply to the remote control feature. It also provides cautionary notes that apply when the remote computer is using a specific operating system.

If a remote computer displays an MS-DOS prompt in full-screen mode, the controller cannot display the computer's screen. When using the remote control feature, always use the MS-DOS prompt in a window.

The controller might be unable to display graphics generated on the remote computer using Direct X (Direct Draw) or OpenGL.

Animation generally takes a large amount of data to send. Do not display animation on the remote computer while a remote control session is in progress.

When the controller attempts to reconnect to a remote computer that did not recognize the controller's disconnection, the Duplicate connection dialog box appears. In this case, select the disconnect option in the dialog box and then reconnect to the remote computer.

Use a color palette with at least 256 colors.

If the Enable pointer shadow check box is selected on the Pointers tab of the Mouse Properties dialog box in the Control Panel, the cursor appears as a double image in the controller, and its shape might be inconsistent between the remote computer and the controller. To resolve this problem, use one of the following methods:

On the remote computer, in the Control Panel, select Mouse, select the Pointers tab, and clear the Enable pointer shadow check box.

In the Properties dialog box of the Remote Control window, click the Optimize Transaction tab and select the Do not show the window animation, etc. check box.

The connection mode changes to shared mode if one of the following occurs while the remote computer is in view mode:

The user presses Ctrl + Alt + Delete on the remote computer

A hardware error or system error message is displayed or closed

A message from the Windows Messenger service is displayed or closed

Applications that simulate keyboard entry or change key assignments will not work correctly while the remote computer is in view mode.

Note the following before hiding the screen of a remote computer you are controlling in exclusive mode. We recommend that you thoroughly check operation in a test environment before using this feature.

The graphics card and monitor of the remote computer must support power saving mode.

The CPU usage might reach 100% on the remote computer, or a residual image might appear on the screen every few seconds.

The blackout of the remote computer's screen might be forcibly lifted. the following table describes when this can happen.

Cause

Description

Disconnection

The administrator disconnects from the remote computer or ends the remote control session.

The user disconnects from the controller or ends the remote control session.

The remote control session was terminated due to a communication error.

Leaving exclusive mode

The user presses Ctrl + Alt + Delete on the remote computer.

A hardware error or system error message is displayed or closed on the remote computer.

A message from the Windows Messenger service is displayed or closed on the remote computer.

Notes on connections to remote computers running Windows Server 2019, Windows Server 2016, Windows 10, Windows 8.1, Windows 8, and Windows Server 2012

Do not disable the following applications in the Startup tab of the System Configuration. If you disable these applications, some remote control features will not work correctly.

jdngrcagent.exe

jdngrcchat.exe

Pointer trails do not appear in the controller when you select the Display pointer trails check box in the Visibility area of the Pointer Options tab, displayed by opening the Control Panel and selecting Hardware and Sound, Devices and Printers, and then Mouse.

If you hide the screen of a remote computer you are controlling in exclusive mode, you cannot send the Ctrl + Alt + Delete key combination from the controller to the remote computer.

If no mouse is connected to a remote computer with the agent installed, the mouse pointer will always be shaped as an arrow in the controller.

Notes on connections to remote computers running Windows 7, Windows Server 2008, or Windows Vista

During remote control sessions, Windows Aero features such as window transparency, taskbar thumbnails, and Windows Flip 3D are disabled.

When you use a Windows Aero mouse pointer, performance of remote mouse control drops. To prevent this, change the mouse pointer design to None. To change the mouse pointer design:

In the Windows Control Panel, click Mouse.

In the Mouse Properties dialog box, display the Pointers tab.

In the Scheme list box, select (None).

Click OK.

Notes on connections to remote computers running Windows 10, Windows 8.1, Windows 8, Windows 7 and Windows Vista

If any of the following operations take place on the remote computer during a remote control session, the session is ended.

The user logs off

The user is switched

A remote connection is established using the Remote Desktop feature

Notes on connections to remote computers running Windows 10

If you are connecting in [Exclusive] connection mode and hide user interface is enabled, the connected computer repeatedly display sign-in screen even if the lock is released, when the following conditions are met.

If the connectied computer belongs to a domain environment.

When [PC wakes up from sleep] is set in Windows [Settings] - [Accent] - [Login] - [Prompt for sign-in]

Notes on connections to remote computers running Windows Server 2019, Windows Server 2016, Windows Server 2012 and Windows Server 2008

If any of the following operations take place on the remote computer during a remote control session, the session is ended.

The user logs off

The user is switched

A console connection is established using the Remote Desktop feature

Notes on connections to remote computers running Windows Server 2003

The remote control feature does not support console connections established by the Remote Desktop feature of Windows Server 2003. If a console connection is established by Remote Desktop, subsequent connection attempts from the controller will be rejected. If the controller is already connected, it will be disconnected.

To connect again, unlock Windows Server 2003 on the remote computer.

Notes on connections to remote computers running Windows XP

The remote control feature does not support the User Switching feature or Remote Desktop feature of Windows XP.

If the remote computer uses user switching or remote connection by the Remote Desktop feature in Windows XP, subsequent connection attempts from the controller will be rejected. If the controller is already connected, it will be disconnected.

To re-establish the connection, take the following action:

If the connection was rejected due to user switching:

Log off all users from Windows XP, and log on again as the first user.

If the connection was rejected due to the Remote Desktop feature:

Unlock Windows on the remote computer.

Important

You cannot use the remote control feature with a computer running Windows 7 in Windows XP Mode.

2.7.15 Transferring files during remote control sessions

You can send and receive files to and from the controller and the remote computer during remote control sessions.

Practical uses include copying files that require maintenance from the remote computer to be worked on locally by the administrator, and transferring troubleshooting tools to run on the remote computer.

Important

You cannot transfer files when using a RFB connection to the remote computer. To transfer files, Allow File Transfer must be selected in the Remote Control Settings in the agent configurations assigned to the remote computer.

Use the File Transfer window opened from the controller to transfer files.

In the File Transfer window, you can view and work with files in a similar manner to Windows Explorer, including the use of simple drag and drop operations. You can also transfer files to multiple destinations in one operation.

Tip

You can transfer files by dragging them onto the screen of the remote computer displayed in the controller. In this case, the File Transfer window appears and file transfer begins immediately. The transferred data is saved to the desktop of the remote computer.

Important

In Windows Server 2019, Windows Server 2016, Windows 10, Windows 8.1, and Windows Server 2012 R2, you cannot transfer files in an environment with OneDrive.

(1) Viewing the file transfer status and canceling file transfer during remote control sessions

When file transfer starts, a File Transfer Progress dialog box appears on the controller and the remote computer (the dialog box is minimized on the remote computer).

To cancel file transfer, click Cancel in the File Transfer Progress dialog box. The Cancel button is available on the controller and on the remote computer. If the button is clicked in the controller, a confirmation dialog box appears asking whether the transfer should be canceled. If the button is clicked on the remote computer, file transfer is canceled immediately.

When you cancel file transfer, files that have already been transferred remain at the destination. If you are moving rather than copying files, files that have already been transferred are deleted from the source computer.

When you transfer files within the same remote computer or from one remote computer to another, files are transferred indirectly via a temporary folder on the controller. In this scenario, the File Transfer Progress dialog box appears twice, once when the files are being transferred from the remote computer to the temporary folder, and again when the files are being transferred from the temporary folder to the remote computer.

(2) Notes on file transfers during remote control sessions

Note the following when using the file transfer feature:

You cannot perform file transfer in the following situations:

The controller is not connected to a remote computer in the Remote Control window

The controller is connected in view mode

The user has not logged on to the remote computer

You cannot transfer files to or from a remote computer that is not configured to allow file transfer. However, if the option to prohibit file transfer is enabled on the remote computer while the File Transfer window is open, you will be able to continue to transfer files until the remote control session is terminated.

When transferring files over a low-speed connection, you can reduce the likelihood of a memory shortage causing a failed transfer by refraining from remote control operations in the Remote Control window during the transfer.

If a network error occurs during file transfer, the system does not always detect that the connection has been lost, and attempts to re-establish the file transfer connection might fail. In this case, you can use the remote control feature or other means to cancel the file transfer in the File Transfer Progress dialog box on the remote computer.

The maximum length of a path of a file which can be transferred is 260 characters in single-byte.

You cannot access folders and files of the reverse point (the symbolic link or junction) with the file transfer feature.

2.7.16 Issuing connection requests from remote computers to controllers

A controller cannot initiate a connection to a remote computer in NAT or NAPT environment where the remote computer is invisible to the administrator's computer. In DHCP environments where IP addresses are assigned dynamically, there is a significant amount of work involved in finding out the IP address you need to specify in the controller.

In this type of environment, because the end user's computer does not have this issue when connecting to the administrator's computer, you can initiate a remote control session by having the user send a connection request to the controller.

Important

Only online-managed computers can send connection requests to a controller.

Having the user send a connection request saves the administrator the trouble of entering a connection destination. This helps avoid situations in which the connection fails because the administrator enters the wrong IP address, and prevents unauthorized controllers from remotely controlling the computer.

The following figure shows the process of starting a remote control session in response to a connection request from a user.

A request server must be present in the connection list in order to receive connection requests from remote computers. After starting the request server, if a request for a remote connection is received from a user (step 1 in the figure), an icon representing the user's computer appears in the connection list. You can then initiate a remote control session by double-clicking the icon (step 2 in the figure).

Related Topics:

(1) Receiving requests from request agents

(1) Receiving requests from request agents

When the request server receives a connection request, the computer that issued the connection request appears below the request server. This computer is referred to as a request agent. The following figure shows an example of a connection list that contains request agents.

By double-clicking the icon for a request agent, the administrator can connect to the remote computer and begin a remote control session.

You can reject a connection request by deleting the request agent or closing the connection list.

When a request server stops, the request agent icon automatically disappears from the connection list. The icon is active as long as the connection request is in effect. It becomes inactive when the connection request is declined.

Important

A request agent icon is a temporary representation of an agent that has issued a connection request. It is not retained after the connection list has closed. To save the information for an agent that issued a connection request, drag the icon to a group of your choice. After you move the icon to another folder, you can save the icon as an item in the agent list. You can then treat the agent as an ordinary computer and change its name and description.

2.7.17 Managing connection targets for the remote control feature

You can manage connection targets for the remote control feature independently of the JP1/IT Desktop Management 2 modules.

By registering remote computers, you can select connection targets directly from the controller, saving you the trouble of searching for connection destinations in the operation window. You can also create groups that let you organize connection destinations in a hierarchy.

Connection destinations are managed in a connection list.

From the connection list, you can search for computers on the network and add remotely controllable computers to the connection list.

(1) Configuring the remote control environment

The remote control feature might be used in diverse environments where computers are distributed across several LANs, or several interconnected WANs and LANs. In these environments, the connection parameters (the environment settings related to the remote control connection) differ between computers, and you need to set the appropriate connection parameters in the controller each time you connect to a remote computer.

You can save time and effort by setting the appropriate connection parameters for individual computers. This allows you to use the correct settings when connecting to remote computers without having to change them each time you connect to a different computer. You can also assign connection parameters when you create items such as computers in the connection list.

Tip

The connection parameters you can assign to individual computers are the same as those set in the Advanced and Connection tabs of the Environment Settings dialog box for the controller. If there are no connection parameters set for a computer, the options set for the controller apply to the connection.

Inheritance of connection parameters

Connection parameters for a computer are inherited as follows:

If you move or copy an agent, the connection options are retained by the moved agent and inherited by the copy of the agent.

If you create a group, a computer, or a network below a group, the connection parameters for the upper-level group are inherited by the group, computer, or network.

(2) Remote control connection log

When you connect to a remote computer with a connection method specified, or you connect to a remote computer from the connection list, the path of the computer appears in the connection log in the Remote Control Agent Specification area of the Remote Control window. Paths are displayed in one of three formats:

hrc://computer-name

A computer for which a standard connection was specified in the connection parameters.

rfb://computer-name

A computer for which an RFB connection was specified in the connection parameters.

list://group-name/computer-name

A computer to which a connection was established from the connection list.

In each path, computer-name is replaced by the IP address or host name of the remote computer, and group-name is replaced by the group configuration of the connection list. If the groups in the connection list are configured in a hierarchy, the names of the groups at each level in the hierarchy are shown.

Example: The path of PC0001 registered in the group /Development Department/3rd Division is displayed as follows:

list:///Development Department/3rd Division/PC0001

2.7.18 Recording and playback of remote control sessions

You can record screen activity at a remotely controlled computer and save the recording as a video file. You can then play back the recorded file on a controller.

Recorded files can also be converted to AVI format and played back on video player software such as Windows Media Player. You can use video recordings in this way to give troubleshooting advice or program operating instructions to a user, even if no controllers are installed in the environment.

Recordings of computer screen activity can be used in the following ways:

Troubleshooting

Some level of proficiency is needed for users to handle computer problems on their own. Understanding what to do is easier if the administrator can describe procedures using a video recording. Problems can be resolved more efficiently without any need for written instructions.

Training

Program operating instructions and work procedures can be recorded and used as training materials. For example, a complicated operation that is difficult to describe in a manual can be more easily conveyed in a video clip.

(1) Viewing the recording status of a remote control sessions

You can check the recording status of a remote control session by displaying the recording status icon in the status bar.

To display the recording status icon, navigate to the Logging tab of the Options dialog box which opens from the Remote Control window. The recording status icon appears only during remote control sessions.

The following icons show the recording status of a remote computer desktop:

: Recording

: Paused

: Stopped

Tip

You can start or stop a recording from the pop-up menu that appears when you right-click the displayed icon.

(2) Settings for efficient video recording of remote control sessions

Selecting a destination file each time you start recording screen activity is an inefficient way of working. You can save time by setting the destination file and file name in advance. You can also set an option to begin recording as soon as you connect to the remote computer.

To set up recording, click the Options button in the tool bar of the Remote Control window. Then go to the Logging tab of the displayed dialog box.

Setting recording files

When you specify a recording file on the Logging tab, all recordings will be automatically saved to that file, which means that the specified file will be overwritten at each recording or you will need to set up a new file each time you record screen activity. However, if you need to manage multiple files of individual recordings, you can set the recording file name using variables. When recording begins, the recording will be saved under the file name with the variables replaced by values. Three different variables can be used in file names:

$(Agent)

Represents the computer name. The value set in this variable is the destination specified on the controller (IP address, host name, or alias).

$(Date)

Represents the date. The date on which the recording started is set in MM-YYYY-DD format (MM: month; YYYY: year; DD: day).

$(Time)

Represents the time. The time at which the recording started is set in hhmmss format where hh is in 24-hour clock notation (hh: hour; mm: minute; ss: second).

You specify a file name incorporating these variables, or you can select one of three file name templates supplied by default.

Some examples of file names that incorporate variables are given below. The computer name in these examples is 10.xxx.xxx.4, the date is April 1, 2011, and the time is 15:05:45. To set file names like these, select a template in the Select Recording File dialog box which opens from the Logging tab.

Selecting a supplied template

From the File type list, select one of the following file name templates:

Recording file (name.jcr)

Example: 10.xxx.xxx.4.jcr

Recording file (name date time.jcr)

Example: 10.xxx.xxx.4 2011-04-01 150545.jcr

Recording file (date time name.jcr)

Example: 2011-04-01 150545 10.xxx.xxx.4.jcr

Specifying a file name that includes variables

In the File name box, type the file name using variables.

$(Agent) $(Date).jcr

Example: 10.xxx.xxx.4 2011-04-01.jcr

UserName (nnn)_ $(Date).jcr

Example: nnn_2011-04-01.jcr

Setting to begin recording at remote connection

To start recording as soon as you connect to the remote computer, select the Start recording when connected check box.

2.7.19 Using the chat feature

While engaged in a remote control session over a standard connection, you can use the chat feature to communicate with users who you cannot contact by telephone. Because the chat feature uses text data, it is also a useful way to provide IP addresses, URLs, and other text-based information in real time.

You can also chat with several users at once.

One use for the chat feature is as a training tool. Because all trainees can be given the same instructions, you can save time by reducing the need to give the same explanation over and over. When trainees raise questions, you can send answers to specific users, or to all users if appropriate.

Important

You cannot use chat over a RFB connection.

The following figure shows an overview of the chat feature:

The chat server must be running before you can initiate a chat session. After you start the chat server, a chat session begins when a computer connects to the chat server from the Chat window. A user can also connect to several chat servers from the Chat window.

During a chat session, you can send the messages entered in the Chat window to other computers. You can send messages to all computers taking part in the chat session, or to individual computers.

(1) Using the chat server icon

When the chat server starts, the chat server icon () appears in the taskbar.

You can perform the following operations from the chat server icon:

View users connected to the chat server

You can view a list of users who are connected to the chat server. This operation (and the corresponding menu item) is unavailable if there are no users connected to the chat server.

Disconnect chat users

You can disconnect users from the chat server. You can disconnect all users, or select specific users to disconnect.

Set parameters

You can set the port number, password, and other parameters of the chat server.

Tip

The chat server icon does not appear in the taskbar in Windows 7 and Windows Server 2008 R2. If you want to display the icon, from the Control Panel select Customizing the desktop and then Customizing the taskbar icon. Set Show icon and notifications for the chat server icon.

2.7.20 Remote control menus

(1) Menus in the Remote Control window

Menu heading

Menu item

Description

File

Connect

Connects to a remote computer. If you are already connected to a computer, the connection is established in a new Remote Control window.

Reconnect

Reconnects to the last connected computer.

Disconnect

Disconnects from the selected computer.

Search

Searches for computers on the network.

Save Screen

Saves an image of the current screen.

Record Screen

Start

Starts recording the on-screen activity of the remote control session.

Pause

Pauses recording of the on-screen activity of the remote control session.

Restart

Resumes the paused recording.

Stop

Stops recording the on-screen activity of the remote control session.

Play Screen

Play

Plays back a remote control session.

Convert

Converts a recording of on-screen activity to an AVI file.

Terminate

Closes the controller program.

Terminate All

Closes all open controller programs.

View

Toolbar

Toolbar

Shows or hides the toolbar.

Button Text Labels

Shows or hides the text-based description of the tool buttons.

Status Bar

Status Bar

Shows or hides the status bar.

Elapsed Time

Shows or hides the time that has elapsed since the connection with the computer was established.

Transfer data

Shows the amount of data transferred to and from the computer.

Key input bar

Action key

Shows registered special keys at the bottom of the Remote Control window.

Register key

Registers a special key.

Refresh

refreshes the screen contents.

Screen Color

Gray Scale

Displays the on-screen activity in grayscale.

256-Color Decrease

Reduces the color palette to 256 colors.

65,536-Color Decrease

Reduces the color palette to 65,536 colors.

65,536-Color Decrease + JPEG Compression

Reduces the color palette to 65,536, and compresses the image data.

No Color Decrease

Shows on-screen information in a full color palette.

Zoom

Cancel

Returns the screen to its original size.

Auto-zoom

Automatically zooms the on-screen information in and out to fit the Remote Control window.

Full Screen

Displays the remote control session in full screen mode.

Tools

Properties

Lets you set the operating environment for the controller.

Mode

View

Sets the connection mode to view.

Shared

Sets the connection mode to shared.

Exclusive

Sets the connection mode to exclusive.

Shut Down

Shuts down the remote computer.

Reboot

Restarts the remote computer.

Send Ctrl+Alt+Del

Sends the Ctrl + Alt + Delete command to the remote computer.

Mount CD/DVD

Makes the CD or DVD drives on the administrator's computer available to the remote computer as a remote CD-ROM drive.

Unmount CD/DVD

Makes the remote CD-ROM unavailable.

Enable IDER Boot

Allows the remote computer to boot from the remote CD-ROM drive.

Transfer File

Displays the File Transfer window.

Chat

Displays the Chat window.

Agent Manager

Add to List

Adds the currently connected computer to the connection list.

Change List

Displays the connection list.

Window

Arrange Vertically

Arranges multiple Remote Control windows vertically.

Arrange Horizontally

Arranges multiple Remote Control windows horizontally.

Arrange All

Arranges multiple Remote Control windows in a uniform tile pattern.

Minimize All

Minimizes all Remote Control windows to icons.

Remote Control

Brings the selected Remote Control window to the front.

Help

Contents

Displays the online help.

Version

Displays version information.

Menu items displayed from the Connect button

Menu item

Description

Connect

Connects to a computer. You can also search for connection-target computers.

Add to List

Adds the currently connected computer to the connection list.

Change List

Displays the connection list.

(2) Menus in the File Transfer window

Menu bar

Menu item

Description

File

Open

Opens the selected file or folder.

New

Folder

Creates a new folder.

Delete

Deletes the selected file or folder.

Rename

Renames the selected file or folder.

Properties

Changes the attributes of the selected file or folder.

Disconnect

Terminates the file transfer connection.

End

Closes the File Transfer window.

Edit

Register for Copying

Registers a file to be copied.

Register for Moving

Registers a file to be moved.

Transfer Files

Starts file transfer.

Select All

Selects all items in the selected drive or folder.

Switch

Inverts the selection.

View

File List

Shows information about files registered for copying or moving.

Selected File

Shows information about the selected file.

Customize

Transfers files to the same folder on multiple computers.

View

Toolbar

Shows the toolbar.

Status bar

Shows the status bar.

Large Icons

Displays files and folders using icons.

List

Displays files and folders in a list.

Details

Shows detailed information (name, size, date modified, attributes) for files and folders.

Parent Folder

Displays the contents of the parent folder of the current folder.

Refresh

Updates the information in the File Transfer window.

Download Manager

Displays the Download Manager window.

Tools

Transfer Options

Allows you to set options related to the appearance and functionality of the File Transfer window.

Help

Contents

Displays the online help.

Version

Shows version information.

(3) Menus in the File Transfer window of the Download Manager

Menu bar

Menu item

Description

File

Delete

Deletes a file saved in the controller.

Close Automatically

Specifies whether the File Transfer window automatically closes when all the files are deleted from the window.

Close

Closes the File Transfer window of Download Manager.

Edit

Transfer Files

Copies files back to their original location on the remote computer.

Delete After Transfer

Moves files back to their original location on the remote computer.

Select All

Selects all the files in the list.

Switch

Inverts the selection.

View

Refresh

Updates the information in the window.

Help

Contents

Displays the online help.

Version

Shows version information.

(4) Menus in the Agent Manager window

Menu bar

Menu item

Description

File

New

Group

Creates a new group.

Agent

Creates a new remote computer.

Network

Creates a network in which you can define a search range for connection-target computers.

Request server

Creates a new request server.

Separator

Inserts a separator.

Import From...

System File

Creates a connection list from the contents of a backup file.

Hosts File

Creates a connection list from the contents of a hosts file.

Connect

Connects to the selected computer. This menu item is unavailable when a network or request server is selected.

Search

Searches for computers in the selected network.

Start

Starts the selected request server.

Stop

Stops the selected request server.

Delete

Deletes the selected item.

Rename

Renames a group, computer, or request server.

Properties

Lets you view or change the properties of a group, computer, or request server.

Save

Saves the current configuration information to the default backup file.

Save As

Saves the current configuration information under a new name.

Close

Closes the connection list.

Edit

Undo

Reverses the last deletion, movement, or modification of data.

Cut

Cuts the selected item.

Copy

Copies the selected item.

Paste

Pastes a cut or copied item to the connection list.

Select All

Selects all items in a folder.

Switch

Inverts the selection.

Shift Up

Moves the selected item up one position in the list.

Shift Down

Moves the selected item down one position in the list.

Find

Lets you specify a keyword to search for in the connection list.

Find Next

Searches for the next occurrence of the keyword in the connection list.

View

Toolbar

Shows the toolbar.

Status bar

Shows the status bar.

Word Wrap

Wraps selected items to fit the window.

Separate

Lines

Displays a separator after each line. You can simultaneously display row separators.

Rows

Displays a separator after each row. You can simultaneously display line separators.

Highlight Selected Line

Highlights the address, description, and creation date/time of the selected item.

Adjust Column Position

Changes the column position so that the address, description, and creation date/time are accommodated within the window.

Help

Contents

Displays the online help.

Version

Shows version information.

(5) Menus in the Remote Control Player window

Menu bar

Menu item

Description

File

New

Starts a new instance of the remote control player.

Open

Lets you select a recording to play back.

Properties

If a file is open, information about the recording is displayed.

Exit

Closes the remote control player.

Play

Play

Starts playing a file that was paused or stopped.

Pause

Pauses playback.

Stop

Stops playback.

Fast forward

Fast forwards through the recording.

Slow

Plays the recording in slow motion.

View

Toolbar

Shows or hides the toolbar.

Status bar

Shows or hides the status bar.

Seek bar

Shows or hides the seek bar.

Zoom

Automatically

Automatically zooms the player window in and out to fit the remote control player window.

50%

Reduces the size of the player window to 50% of its original size.

100%

Displays the player window at its original size (100%).

200%

Enlarges the player window to 200% of its original size.

Full Screen

Displays the view in full screen in the controller.

Window

Arrange Vertically

Arranges the remote control player windows vertically.

Arrange Horizontally

Arranges the remote control player windows horizontally.

Arrange All

Arranges multiple remote control player windows in a uniform tile pattern.

Minimize All

Minimizes all remote control player windows to icons.

Fit to Frame

Resizes the playback window to fit the remote control player.

Help

Contents

Displays the online help.

Version

Shows version information.

(6) Menus in the Chat window

Menu bar

Menu items

Description

File

Connect

Connects to the chat server. If you are already connected to a chat server, you can use this item to connect to another chat server.

Disconnect

Disconnects from the connected chat server.

Properties

Displays detailed information about the selected user.

Send Message

Sends the chat message entered in the message input box.

Send Beep

Sounds a single beep on the computers of the other users participating in the chat session.

Save

Overwrites the save file with the transcript of the current chat session.

Save As

Saves the transcript of the current chat session to a new file.

Print

Prints the transcript of the current chat session.

Print Preview

Displays a print preview of the transcript of the current chat session.

Exit

Closes the Chat window. The connection with the chat server is automatically disconnected.

View

Toolbar

Shows or hides the toolbar.

Status Bar

Shows or hides the status bar.

Tools

Options

Lets you set the operating environment for the Chat window.

Chat Server

Start Chat Server

Toggles the chat server on and off. A tick appears beside this item when the chat server is on.

Hide When Minimized

Causes the Chat window to disappear from the taskbar when minimized. A tick appears beside this item if enabled.

Start When Windows Starts

Registers or removes the chat server in the Windows startup group. A tick appears beside this item when the chat server is registered in startup.

Remote Control

Initiates a remote control session by connecting to the selected user. This item is unavailable if the Chat window was opened on an agent.

Help

Contents

Displays the online help.

Version

Shows version information.

(7) Menus during remote control sessions (full screen mode)

When you use the remote control feature in full screen mode, you can display menus by right-clicking the menu bar. From these menus, you can change the screen color depth, connection mode, and other settings.

To close the menu, click Cancel in the menu.

The following table lists the items that appear in the menus.

Item

Description

View

Menu bar

Display Automatically

Select this option to automatically display the menu bar when you move the mouse cursor to the top of the window.

Display at All Times

Select this option to keep the menu bar displayed at all times regardless of where the mouse pointer is located.

Refresh

Refreshes the information in the remote control window.

Screen Color

Gray Scale

Reduces the color palette to 8-color grayscale.

256-Color Decrease

Reduces the color palette to 256 colors.

65,536-Color Decrease

Reduces the color palette to 65,536 colors.

65,536-Color Decrease + JPEG Compression

Reduces the color palette to 65,536, and applies JPEG compression to screens that display a high number of colors.

No Color Decrease

Shows on-screen information in a full color palette.

Minimize

Minimizes the remote control window.

Restore

Exits full screen mode and displays the remote control session in a window.

Tool

Mode

View

Changes the connection mode to view.

Shared

Changes the connection mode to shared.

Exclusive

Changes the connection mode to exclusive.

Send Ctrl + Alt + Del key

Sends the Ctrl + Alt + Delete command to the remote computer.

Cancel

Closes the pop-up menu.

Exit

Terminates the remote control session and closes the window.

2.8 Managing network connections

With the proliferation of wireless LANs and mobile devices, there is a risk of employees or outsiders bringing their personal devices onto company premises and connecting to your company network. Unsecured devices are a potential source of virus infections and a way to remove data without authorization. To avoid these and other issues, you need to have a clear picture of the devices that connect to your network, and manage them proactively.

By using the network monitor feature, you can protect your corporate network by blocking unauthorized devices. You can also use this feature to detect, in real time, attempts by unknown devices to connect to the network.

To use the network monitor feature, you select a computer in a segment and install the network monitor agent on that computer. Installing the network monitor agent enables the network monitor feature, allowing connections among computers in that segment to be allowed or blocked as needed. Because network monitor agents are managed at the segment level, you will need to install a network monitor agent in each segment in environments that consist of multiple segments.

Note that you cannot block the network connection of a management server, a relay system, or a computer with the network monitor agent installed. In the case of an agent for UNIX or Mac, you can manually grant or deny network connection.

2.8.1 Detecting devices by using the network monitoring function

You can detect a new device attempting to access the network by enabling the network monitor for the network segment groups displayed in the Network List view. To display the Network List view, in the Inventory module, select Device Inventory and then Network List. A network search is automatically performed for the detected device. If the device is discovered, its access to the network is controlled according to the network monitor settings.

Important

Before using the network monitoring function, make sure that you are fully aware of the devices to which network access is granted and those to which network access is denied. If network access control is applied incorrectly, network access control can cause unexpected business interruptions, for example, by disabling network access for devices used for business operations.

Important

The network monitoring function is not available for shared VDI-based virtual computers.

Tip

You cannot use network control to disconnect connections with a management server, a relay system, or a computer on which network access control is enabled.

Tip

To detect devices, enable the network monitor for a single computer on which an agent is installed per network segment. By installing an agent on and enabling the network monitor for a computer capable of accessing multiple networks using multiple network cards, you can monitor multiple network segments using just one computer. Set an appropriate IP address range for the network segment and assign the corresponding authentication information. If a detected device has a network address that is outside the IP address range, a search is performed without using the authentication information. In this case, only the MAC address and IP address information is acquired from that device.

The following figure shows how a device connected to the network is detected and registered inJP1/IT Desktop Management 2:

The computer on which an agent is installed and for which the network monitor is enabled detects a device attempting to access the network.

The computer on which an agent is installed and for which the network monitor is enabled notifies the management server that a device has been detected.

Based on the received information, the management server searches the network for the detected device.

Important

If a search for devices (network search) is already running, the system waits until the search ends. If the network monitoring function is taking long time to detect devices, implement countermeasures such as narrowing the search range of the device search (network search).

Tip

If you want to perform agentless authentication when the device is discovered, you need to set the IP address range that includes the IP addresses monitored by the network monitor as well as the corresponding authentication information in advance.

If the device is discovered during the search, it is automatically included as the management target or an agent is automatically deployed to it, depending on the search conditions.

Important

The network monitoring function cannot detect devices in the network segments that cannot be accessed directly from the management server, such as networks through NAT.

To use the network monitoring functions in a network connected via NAT, you must build a multi-server configuration system where a management server is installed for each network segment.

Important

If you have enabled the setting for automatically deploying an agent to a device discovered during network search, an agent is deployed to a discovered computer even when that computer is denied network access.

Under this circumstance, an agent is installed on a computer that is denied network access. Depending on the network control setting specified in the security policy and the result of a security check performed for that computer, the computer might be able to access the network.

Important

If you remove a device that has been discovered by the network monitoring function, that device cannot be rediscovered until you disconnect from the network and then reconnect to it. If the time interval between network disconnection and reconnection is too short, the device might not be rediscovered.

Tip

Regardless of whether Permit or Not Permit is specified in the network monitor settings, devices accessing the network can be discovered. If the network monitor discovers a device, a network search is automatically performed for that device. If you have enabled the Auto-Manage Discovered Nodes or Auto-Install Agent setting for the network search, the device discovered by the network monitor is automatically included as a management target or an agent is automatically deployed to the device. The device then becomes a management target, and a product license is used for that device.

If you do not want to automatically include a discovered device as a management target, clear the Auto-Manage Discovered Nodes and Auto-Install Agent check boxes in Configurations so that you can manually select management targets.

The network monitoring function monitors the following networks:

IPv4 networks. The IPv6 networks are not supported.

Only computers that use standard TCP/IP can be monitored.

The network monitoring function monitors TCP/IP network protocols. Protocols such as NetBEUI and IPX are not supported.

To control devices accessing a wireless LAN, make sure that the access point relays MAC address information. If the access point does not relay MAC address information, network control cannot be performed.

2.8.2 Settings for controlling network connections

By enabling the network monitor feature in a network segment, you can control the network access of all devices in that segment. To control network connections of the devices, an administrator must understand the status of the network segment. Therefore, device network connections are controlled on a management server basis. This section describes how to configure the network monitor feature to control access to the network.

Implementing the network monitor feature

To implement the network monitor feature, enable the network monitor in each segment where you want to monitor network access. You can then configure whether to permit devices to access the network in each of those segments. You can enable the network monitor on one computer in each network segment. The computer must have the agent installed. If you attempt to enable the network monitor on a second computer, an error message is displayed.

Tip

By viewing the Topic panel of the Home module, you can find out if there are any network segments without the network monitor enabled. A warning message appears if there are any such network segments.

Important

Network devices such as routers, switches, and network printers are less likely to communicate with the devices, so it may not be detected by the network monitor immediately after start of operations with enabled network monitor.

Setting the control method for network access

The following settings govern how network connections are controlled in network segments with the network monitor enabled:

Whether newly discovered devices are permitted to connect to the network (network monitor settings)

In the network monitor settings, you can set whether newly discovered devices in each network segment are permitted to connect to the network. Network monitor settings are assigned to computers with the network monitor installed. You can select which network monitor settings to assign when you enable the network monitor. You can later change the network monitor settings assigned to a network segment, or assign a different set of network monitor settings.

For details about how to manage network monitor settings, see 2.8.6 Using network monitor settings to control network access.

Whether specific devices are permitted to connect to the network (network control list)

In a network control list, you can define whether individual devices are permitted to connect to the network. When a device is discovered, it is automatically added to the network control list. Whether that device can connect to the network depends on the network monitor settings. By editing the settings in the network control list, you can control the network connectivity of individual devices. You can also permit a device to connect to the network only within a certain time period by setting a start date/time and end date/time.

Tip

You cannot specify a time period for network access by a management server, relay system, or a computer with network monitor enabled.

Tip

When you designate a discovered device as a management target or exclusion target, that device is automatically granted network access in the network control list. This is because the device is now seen as belonging to your organization.

Important

To prevent routers, printers, servers, and other business-critical devices from being blocked due to automatic update of the network control list, we recommend that you manually enter the IP addresses of these devices in the network control list. When doing so, leave the MAC address field blank. If you enter a MAC address, the device might disappear from the network control list when its device information is updated. For details about the automatic update of the network control list, see 2.8.15 Automatic updating of the network control list.

Tip

When you register new device information or edit existing device information in the network control list, the Reviewed check box of the device in question becomes selected. This check box indicates devices that require the administrator's attention and ensures that devices are not unintentionally blocked or permitted to connect to the network. The administrator must check the devices for which the Reviewed check box is selected, and then clear the check box after verifying that there are no problems. Note that the check box can be cleared at any time.

For details about how to manage the network control list, see 2.8.8 Managing the network control list.

The network monitor settings and the network control list together govern a device's ability to connect to the network. By combining these settings, you can implement the following forms of network control:

Permit newly connected devices to connect to the network, but deny network access to specific devices registered in the network control list (blacklist method)

For Discovered Nodes Option in the network monitor settings, select Allow Network Access. New devices added to the network will have access to the network.

Permit network access by devices registered in the network control list, and deny access to all other newly connected devices (whitelist method)

For Discovered Nodes Option in the network monitor settings, select Deny Network Access.

To automatically grant network access to new devices in this situation, permit connections for devices whose violation level is Safe in Network Connection Control under Action Items in the security policy. New devices are initially blocked from the network when they connect to the management server, but are permitted access to the network as soon as they are judged safe.

Exclusive communication destinations for blocked devices

Devices blocked by the network monitor feature can communicate with only computers with the network monitor enabled in the network segment and computers registered in the Exclusive Communication Destination for Access-Denied Devices list. For details about communication by blocked devices, see 2.8.13 Registering devices that are accessible to blocked devices.

You might have to specify the exclusive communication destination depending on the network environment of the organization. The following describes the cases in which exclusive communication destinations must be specified and examples of Exclusive Communication Destination for Access-Denied Devices settings.

When the exclusive communication destination must be specified

Description

Example of Exclusive Communication Destination for Access-Denied Devices settings

The DNS server is used to resolve the device names in the organization.

If the DNS server is used to resolve the device names in the organization, set the IP address of the DNS server for Exclusive Communication Destination for Access-Denied Devices. If the DNS server's IP address is not set and another IP address is set for Exclusive Communication Destination for Access-Denied Devices, name resolution will fail. As a result, network access using the host name will not be possible when the blocked devices connect to the exclusive communication destinations.

Destination IP Address: IP address of the DNS server

Communication Protocol: No specification

Destination Port Number: No specification

Source IP Address: No specification

Source Port Number: No specification

NetBios broadcast is used to resolve the name of a device in the organization.

If NetBios broadcast is used to resolve the name of a device in the organization, set the broadcast address for Exclusive Communication Destination for Access-Denied Devices. If the broadcast address is not set, name resolution will fail. As a result, devices with the network monitor enabled will no longer be able to access the network by using the host name.

Destination IP Address: Broadcast address (example: 192.168.1.255)

Communication Protocol: UDP

Destination Port Number: 137

Source IP Address: No specification

Source Port Number: No specification

A device with the network monitor enabled is the DHCP server#

If a device with the network monitor enabled is the DHCP server, set IP address 0.0.0.0 for Exclusive Communication Destination for Access-Denied Devices. If 0.0.0.0 is not set, IP address assignment will fail. As a result, the devices with no IP address assigned will no longer be able to access the network.

Destination IP Address: 0.0.0.0

Communication Protocol: UDP

Destination Port Number: 68

Source IP Address: Subnet mask in CIDR format (example: 255.255.255.0/24)

Source Port Number: 67

#: The DHCP server can automatically assign IP addresses. However, if the network monitor is installed in a Windows environment, the Remote Access feature (Incoming Connections) of Routing and Remote Access Service that is enabled at installation reserves 10 IP addresses. This reduces the number of IP addresses that can be assigned by 10. You can prevent this problem in the following OSs by stopping the Remote Access feature:

Windows Server 2019

Windows Server 2016

Windows 8.1

Windows 8

Windows Server 2012

Windows 7

Windows Server 2008 R2

To stop the Remote Access feature:

Open the command prompt window with Administrator permissions.

Execute the netsh ras show type command at the command prompt.

Confirm that Enabled is displayed for IPv4 Remote Access Server at the command prompt.

Execute the following command at the command prompt to stop the Remote Access feature:

netsh ras set type ipv4rtrtype = lanonly ipv6rtrtype = none rastype = none

Restart the Routing and Remote Access Service service.

Execute the netsh ras show type command at the command prompt.

Confirm that Disabled is displayed for IPv4 Remote Access Server at the command prompt.

Related Topics:

2.8.10 Managing network access using a whitelist

2.8.9 Managing network access using a blacklist

2.8.3 Notes on network monitoring

If the network monitor is enabled on a computer, and you want to change the IP address or dispose of that computer or add a new network to be monitored by that computer, you must first disable the network monitor. In the Assign Network Access Control Settings window, disable the network monitor. Then change the IP address or add a new network as a monitoring target, and then enable the network monitor again.

To disconnect a computer on which the network monitor is enabled from the network, you must first disable the network monitor running on it because, after the computer is disconnected from the network, you can no longer disable the network monitor running on it. If you accidentally disconnect a computer from the network before disabling the network monitor running on it, you must first reconnect the computer to the network, disable the network monitor, and then disconnect the computer again from the network.

The Windows Firewall is automatically disabled on computers with the network monitor enabled or JP1/IT Desktop Management 2 - Network Monitor installed. Keep the Windows Firewall disabled on these computers. If you enable the Windows Firewall or the firewall feature of a security suite or other software, you might be unable to use the communication channels specified in Exclusive Communication Destination for Access-Denied Devices.

Computers with the network monitor enabled or JP1/IT Desktop Management 2 - Network Monitor installed use the Routing and Remote Access service. Do not stop the Routing and Remote Access service on these computers. In Windows Server 2012 and Windows Server 2008 R2, do not stop the Routing and Remote Access Windows role service.

Devices with the network monitor enabled can be blocked from the network in the following circumstances. In this case, stop the Routing and Remote Access service or restart the computer.

The network monitor is disabled

JP1/IT Desktop Management 2 - Network Monitor is uninstalled

We recommend that you use a wired LAN connection for computers with the network monitor enabled. If you use a wireless LAN, the system might have trouble detecting and rejecting the LAN connections of unauthorized computers when there are problems in the communication environment.

A blocked device for which an exclusive communication destination is specified must be able to communicate with the computer where the network monitor is enabled (the network access control agent). For this reason, blocked devices are able to communicate with the network access control agent even if the agent does not appear in the list of exclusive communication destinations. Do not create an environment in which a file server or other business-critical machine also functions as a network access control agent. A situation might arise in which an insecure device compromises the security of the business-critical machine.

If blocked devices are permitted to access the network, they might require several minutes to access the network. If the devices cannot access the network after several minutes have passed, restart the user's computer.

When the network monitor monitors a network in which IP addresses are allocated dynamically by a DHCP server, the IP addresses that the DHCP server attempts to lease to unauthorized computers are managed as in-use for a fixed period of time. If the network monitor blocks a large number of these unauthorized computers, the pool of available IP addresses is depleted. For this reason, we recommend that you promptly remove blocked computers from the network.

Devices that fall under any of the following categories cannot be detected or blocked.

Device not using IPv4

Device not sending/responding to ARP

Device with any of the following assigned as the IP address

(a) Link-local address (169.254.0.0 to 169.254.255.255)

(b) All zeros (0.0.0.0)

(c) Broadcast address (e.g. 192.168.1.255 for 192.168.1.0/24)

(d) Network address (e.g. 192.168.1.0 for 192.168.1.0/24)

(e) Outside the monitored network (e.g. anything other than 192.168.1.1 to 192.168.1.254 for 192.168.1.0/24)

Device with same MAC address as the MAC address in the network monitor

Devices that meet the following criteria can be detected but not blocked.

The MAC address is all zeros (00:00:00:00:00:00)

To enable network monitor for the computer to which the network adapter has been added or deleted, make sure that the network adapter information is already applied to the device from the inventory screen before enabling the network monitor. If network monitor is enabled before the network adapter information is applied, re-enable the network monitor after confirming that the network adapter information has been applied.

For devices with "Random Hardware Address" enabled in the Windows settings, or devices with VPN software installed, a different MAC address is notified each time the OS is restarted, etc., so a large number of unnecessary MAC addresses are registered in the network control list. If the network control list exceeds its upper limit (262,140), network connections of devices registered after that cannot be controlled. To prevent the network control list from exceeding its upper limit, periodically delete unnecessary MAC addresses from the network control list, or set an option to suppress the registration of randomized MAC addresses.

For information on setting the option to suppress the registration of randomized MAC addresses, see DisableNCListUpdate in A.5 Lists of properties .

2.8.4 Displaying the operating status of the network monitor

When monitoring a network, icons are used to indicate which network segments are being monitored. The operating statuses of the network monitor are as follows:

: Managing

The network is being monitored. The network monitor is enabled on a computer in the network segment.

: Starting management

The network is not being monitored. The network monitor is being enabled on a computer in the network segment.

: Failed to start management

The network is not being monitored. The network monitor failed to start.

: Non-management

The network is not being monitored. The network monitor is disabled.

: Stopped management

The network is being monitored. The network monitor that was enabled on a computer in the network segment is being disabled.

: Failed to stop management

The network is being monitored. An attempt to disable the network monitor has failed.

The operating status of the network monitor appears in the following windows:

The menu area in the Device Inventory - Network List view in the Inventory module

The menu area in the Computer Security Status - Network List view in the Inventory module

The information area in the Network Access Control - Assign Network Access Control Settings view of the Settings module

2.8.5 Changing the network access control agent

If a change of circumstances such as the replacement or repurposing of hardware means that you need to change the computer on which the network monitor is enabled, disable the network monitor and then enable it on another computer.

To change the network access control agent:

Disable the network monitor.

When you disable the network monitor, the network monitor agent is uninstalled from the computer and the operating status appears as Non-management in the menu area. At this time, monitoring of the network temporarily stops.

Enable the network monitor.

After the network monitor is disabled, enable the network monitor on the computer that you want to use as the network access control agent.

After enabling the network monitor on a computer, you can monitor the network segment where the computer is located.

2.8.6 Using network monitor settings to control network access

By enabling the network monitor on a computer, you can control whether the devices in the network segment where the computer is located are permitted to connect to the network. To control network access differently in different network segments, you need to assign network monitor settings to each network segment.

By creating several sets of network monitor settings and assigning them to the appropriate network segments, you can create a network environment in which, for example, network segments with more stringent security requirements do not permit network access by new devices while others do.

In a multi-server configuration, you can enable or disable network monitoring, or assign network monitor settings only on the computers within a network segment directly under each management server.

The following figure shows an overview of allocating network monitor settings.

You can vary how network access is controlled in each network segment by creating several sets of network monitor settings. You can create network monitor settings in the Network Access Control - Network Access Control Settings view of the Settings module.

After creating network monitor settings, you need to assign them to network segments. You can assign network monitor settings in the Network Access Control - Assign Network Access Control Settings view of the Settings module.

Important

If you have configured the system to automatically distribute the agent to devices discovered on the network, the agent program will be distributed to a discovered computer even if the computer is not permitted to access the network.

For this reason, depending on the network access control settings and the results of a security assessment, a situation might arise in which a computer that is not permitted network access is able to access the network.

Important

In a multi-server configuration, do not mix computers managed by different devices in a single network segment. Network monitor settings assigned by different managing devices might conflict, and you might not be able to control network connections properly.

Tip

You can detect networked devices regardless of whether Permit or Do not Permit is set in the network monitor settings. Devices detected by the network monitor are automatically subjected to network discovery. When the network monitor detects a device, any actions specified in the discovery conditions such as automatically registering the device as a management target or automatically distributing the agent program will take place. In this case, the device becomes a management target and uses one product license.

If you do not want to automatically register devices as management targets, clear the Auto-Manage Discovered Nodes and Auto-Install Agent check boxes in the discovery options, and manually register devices as management targets.

2.8.7 Managing network monitor settings

Network monitor settings allow you to control the network at the network segment level.

There are four network monitor settings: a standard setting that permits network access by default, a setting that does not permit network access, a setting that permits and does not block network access, and a setting that does not permit and does not block network access. If one set of network monitor settings is all you need, you can easily change the settings across the entire system by allocating the standard setting to every network segment.

Note

The default network monitor settings "Default Setting (Do Not Block Network Access)" and "Not Permit Setting (Do Not Block Network Access)" will be made available upon the initial configuration or reconfiguration of management servers. These settings will not be available through upgrades.

Create network monitor settings if you need to use different network monitor settings in different network segments.

Edit network monitor settings if you need to change how network access is controlled.

Delete network monitor settings if changes to how you use the system mean that those settings are no longer required.

After creating network monitor settings, remember to allocate them to the appropriate network segments.

For details about managing network monitor settings, see the description of managing network monitor settings in the manual JP1/IT Desktop Management 2 Administration Guide.

Tip

Events that are issued when the block target devices access the network trigger a network search to locate the devices accessing the network. You can enable the issuance of events while creating network monitor settings, as follows: Select Network Access Control , Network Access Control Settings, and then Add button. In the displayed Add Network Access Control Settings dialog box, select the Only detect nodes and do not block network access. check box.

When the default network monitor setting "Standard (Do Not Block)" or "Deny Access (Do Not Block)" is enabled, the Only detect nodes and do not block network access. check box is selected by default.

2.8.8 Managing the network control list

By using the network control list, you can control network access at the device level. You can also specify a time period during which a device is permitted to access the network. Newly discovered devices are automatically registered in the network control list, but an administrator can register devices manually when needed.

To control network access at the device level, add devices to the network control list.

You can change the network access of a specific device by editing its entry in the network control list.

Devices that were manually added to the network control list, and devices that are out of the network control list automatic update target in a multi-server configuration can be removed from the list.

Information (in the network control list) about whether the devices are permitted to connect to the network can be exported or imported from the operation window.

Fore details about managing the network control list, see the description of managing the network control list in the manual JP1/IT Desktop Management 2 Administration Guide.

Tip

By combining network monitor settings with the contents of the network control list, you can use a whitelist or blacklist approach to controlling network access.

Tip

You can update the network control list for the management server by executing the network control command (jdnrnetctrl command).

Tip

When the Enable all automatic updates check box is selected in the Automatic Updates on Network Filter List dialog box: If you delete a device whose network access is set to Permit, the device is also deleted from the network control list. This prevents the information for the device from being misused in the future. Conversely, if you delete a device whose network access is set to Not Permit, the device remains in the network control list to ensure the Not Permit setting is maintained if the device is changed.

When the Enable all automatic updates check box is not selected in the Automatic Updates on Network Filter List dialog box (that is, automatic updating for only additions is enabled): If you delete a device, the entry for the device remains in the network control list regardless of whether Permit or Not Permit is set.

Important

When you use a MAC address to enter a device in the network control list, the MAC address is correlated with any device information JP1/IT Desktop management collects for the device. This means that the host name or other information will be displayed instead of the MAC address. After this occurs, you can no longer delete the device from the network control list window. To delete such a device, use the Settings module.

Tip

When you register new device information or edit existing device information in the network control list, the Reviewed check box of the device in question becomes selected. This check box indicates devices that require the administrator's attention and ensures that devices are not unintentionally blocked or permitted to connect to the network. The administrator must check the devices for which the Reviewed check box is selected, and then clear the check box after verifying that there are no problems. Note that the check box can be cleared at any time.

Related Topics:

2.8.9 Managing network access using a blacklist

2.8.10 Managing network access using a whitelist

2.8.9 Managing network access using a blacklist

You can take a blacklist approach to managing network access, whereby a list is kept of devices for which you want to deny network access. We recommend this approach when there are specific devices, such as computers that must operate on a standalone basis or personal computers employees bring from home, whose network access might present a security risk.

Tip

When you first begin to monitor the network, you need to permit network access for a large number of devices. In this type of scenario, a blacklist can save you time by allowing you to permit network access for all devices, and then identify computers that should not have access to the network as time permits.

The following figure shows an overview of network access control using a blacklist approach.

1. Register devices for which you want to deny network access.

In the Network Access Control - Network Filter Settings view of the Settings module, register devices that should not have network access. For details about how to manage the network control list, see 2.8.8 Managing the network control list.

2. Permit network access by all devices.

In the Network Access Control - Assign Network Access Control Settings view of the Settings module, assign a network monitor setting to all network segments that permits network access. For details about network monitor settings, see 2.8.7 Managing network monitor settings.

As a result, only the devices you registered in step 1 are blocked from the network.

When one of these devices attempts to connect to the network, it is blocked and an event is generated.

2.8.10 Managing network access using a whitelist

You can use a whitelist approach to managing network access, whereby only the devices you register in a list are able to connect to the network. We recommend that you use this approach when you need to provide a more robust security environment.

The following figure shows an overview of network access control using a whitelist approach.

1. Register devices for which you want to permit network access.

In the Network Access Control - Network Filter Settings view of the Settings module, register the devices for which you want to permit network access. Be sure to register management servers, computers with the network monitor agent installed, and other devices that require a persistent connection to the network. Newly added devices are automatically added to the network control list. For details about how to manage the network control list, see 2.8.8 Managing the network control list.

2. Block network access by devices not registered in the network control list.

In the Network Access Control - Assign Network Access Control Settings view of the Settings module, assign a network monitor setting to all network segments that denies network access. Any unlisted devices that attempt to connect to the network will be blocked. For details about network monitor settings, see 2.8.7 Managing network monitor settings.

As a result, only permitted devices are able to connect to the network. If a non-permitted device attempts to connect to the network, it is blocked and an event is generated.

Tip

If you have configured the system to block network access by new devices in the Network Access Control view of the Settings module, a new device is blocked when it attempts to connect to the network. In this case, you can automatically grant network access to new computers by installing the agent program on the computer and assigning a security policy whose violation level is configured to permit network access in the Network Connection Control settings under Action Items. When a computer with the agent installed connects to the network, its ability to access the network is determined based on the result of a security assessment. If it is permitted network access as a result, the computer is automatically added to the network control list.

Important

When using the whitelist approach to manage network access, remember to permit network access by routers, switches, network printers, and other devices not directly managed by JP1/IT Desktop Management 2. A lack of network connectivity for such devices also prevents any downstream devices from accessing the network.

To use the whitelist approach to manage network access, change the automatic update setting of the network control list if necessary. By default, automatic updating for only additions is enabled.

If you want to automatically prevent a network connection device (such as a NIC) from being misused in the future, enable all automatic updates. However, if one of the conditions below exists, the system assumes that the network connection device (such as a NIC) has been removed, and deletes the device from the network control list. As a result, the device can no longer access the network.

The network is disabled (by, for example, disabling the local area connection by using My Network Places).

The network cable is removed from the device.

A wireless LAN card is removed.

2.8.11 Timing of network control list updates

The following table describes the events that result in the network control list being updated.

No.

Timing of update

Example

Remarks

1

Device connection detected by network monitor

The network monitor feature detects a connection from a device while monitoring the network.

If a device connects to and then immediately disconnects from the network, a situation might arise in which the manager detects the connection but cannot acquire the IP address or MAC address of the device, preventing its addition to the network control list.

2

Device connection detected by device search

A network-connected device is discovered by a device search.

--

3

Adding or deleting a managed device

A device is deleted in the Device Inventory - Device List view of the Inventory module.

An administrator adds a management target in the Discovery - Discovered Nodes view of the Settings module.

An administrator adds an exclusion target in the Discovery - Discovered Nodes view of the Settings module.

An administrator deletes a device from the Discovery - Managed Nodes view of the Settings module.

A device is set to Ignored in the Discovery - Managed Nodes view of the Settings module.

An administrator deletes a device from the Discovery - Discovered Nodes view of the Settings module.

A device is set to Managed in the Discovery - Ignored Nodes view of the Settings module.

An administrator deletes an exclusion target from the Discovery - Ignored Nodes view of the Settings module.

An administrator deletes a device from List of Devices Suggested for Deletion in the Device Maintenance Settings and Detection Results view that opens from Inventory of the Settings module.

If device information can be collected from the managed device, and the device incorporates more than one component with network connectivity (such as NICs), each of those components is added to the network control list.

Ordinarily, a device is added to the network control list when discovered by the network monitor or a device search. Devices are not added to the network list in response to the addition or deletion of a managed device, unless the device is deleted manually.

In environments that use a whitelist approach to network access control, a computer that becomes a management target by installation of the agent program is not initially able to access the network. To automatically grant such computers network access, assign a security policy that permits network access in the Add Security Policy dialog box, or in the Action Items - Network Connection Control view of the Edit Security Policy dialog box.

4

Network connection hardware (such as a NIC) is changed

An administrator adds or removes a network connection device (such as a NIC) to or from a managed device.

The IP address assigned to a managed network connection device (such as a NIC) changes (including IP address changes in a DHCP environment).

When changes are made to the configuration or settings of a network connection device (such as a NIC) in an environment where device information can be collected from managed devices, the changes are reflected in the network control list.

5

Network access is manually permitted or denied

You select Allow Network Access or Deny Network Access in the Device Inventory - Device List view of the Inventory module.

You select Allow Network Access or Deny Network Access in the Computer Security Status - Device List view of the Security module.

The changes you make in these windows apply to the setting (allow/deny network access) for the device in the Connection to Network part of the network control list.

6

Automatic network access control resulting from security assessment

A device for which a Network Connection Control setting is enabled and a Violation Level (for controlling computer network connection) is assigned in the Edit Security Policy view for the security policy selected in the Security Policies - Security Policy List of the Security module is subjected to network access control.

Depending on the security policy setting, the device is automatically permitted or denied network access. The automatic setting applies to the setting (allow/deny network access) for the device in the Connection to Network part of the network control list.

7

New hardware registration, modification, or disposal

A new hardware asset is added with an IP address or MAC address specified.

The IP address or MAC address of a hardware asset is changed.

An administrator changes the Asset Status of a hardware asset to Disposed.

Applies to hardware assets that are not associated with a device. Hardware assets associated with devices takes its settings from the device.

The result is the same as if the information were added, changed, or deleted manually.

8

Manual addition, modification, or deletion of network control list entries

An administrator adds, changes, or deletes data manually in the Network Access Control - Network Filter Settings view of the Settings module.

Data in the network control list that is associated with a device or hardware asset takes its value from the last change that was made to the device, hardware asset, or network control list, whether by an automatic or manual operation. Keep in mind that the value might be changed by an automatic process.

9

Notification of device information from a management relay server under the local server

In a multi-server configuration, the network control list is automatically updated based on the device information added, modified, or deleted by a management relay server under the local server.

Multi-server configuration is required, and the Network Access Control - Network Filter Settings view of the Settings module must be configured so that devices managed by a management relay server under the local server are automatically updated.

10

CSV-file import of information on whether network connection is allowed or denied

A CSV file is imported from the Action menu of the Network Access Control - Network Filter Settings view of the Settings module.

--

11

Execution of the network control command (jdnrnetctrl command)

The network control command (jdnrnetctrl command) is executed.

--

Legend: --: Not applicable.

Important

If the management server is under a heavy load, it might take some time for changes to the network control list to take effect.

2.8.12 Settings in the network control list

The following table describes the settings you need to enter in the network control list for devices used in particular ways.

Device usage

Settings in network control list

Used with fixed IP address

Register the MAC address and IP address of each NIC in the list, using any judgment form.

Used in DHCP environment

Set the judgment form to MAC Address.

Multiple IP addresses assigned to one MAC address

Set the judgment form to MAC Address

Using NIC teaming

Register the virtual MAC address in the list.

Used in a cluster environment

Register the physical IP address and logical IP address in the list.

Using several devices with one NIC

Register the corresponding IP addresses in the list in the following format:

Judgment form: IP address

MAC address: Do not enter

IP address: The IP address for the device.

When more than one of the following devices might have the same host ID:

Printer

Networking equipment

Devices on which the agent was installed through a disk copy

2.8.13 Registering devices that are accessible to blocked devices

Some devices remain accessible to a device that has been blocked from the network by the network monitor feature: The computer in the same network segment that has the network monitor enabled, and any computers registered in Exclusive Communication Destination for Access-Denied Devices. Management servers and relay systems are automatically registered in Exclusive Communication Destination for Access-Denied Devices.

For example, if you register a server that provides security measures in Exclusive Communication Destination for Access-Denied Devices, a device that is blocked after being deemed a security risk can connect to the server to take security measures. The following figure shows an example in which a server that provides security measures is registered in Exclusive Communication Destination for Access-Denied Devices.

In Exclusive Communication Destination for Access-Denied Devices, only register computers that are fully secure and can communicate with quarantined devices without introducing a security risk.

Important

When controlling network access based on the results of security assessment, do not remove the management server from Exclusive Communication Destination for Access-Denied Devices. If you do, you will be unable to judge the security status of devices, preventing network access from being controlled on this basis. If you inadvertently remove the server, add it again manually.

Important

If you use Remote Install Manager for distribution, never delete management servers or relay systems from Exclusive Communication Destination for Access-Denied Devices. Deleting those devices makes it impossible to perform distribution. If you delete a management server or relay system by mistake, add it in Exclusive Communication Destination for Access-Denied Devices manually.

Tip

You can use the remote control feature with blocked devices by adding the computer on which you use the controller to Exclusive Communication Destination for Access-Denied Devices.

2.8.14 Automatically controlling network access

In an environment with the network monitor enabled, devices are automatically subjected to network access control based on a number of factors, including the results of assessment against a security policy and the nature of the device information registered for the device. For example, a computer that violates a security policy might be automatically blocked from the network, and then automatically unblocked after the issue is resolved.

Levels of priority apply to network access control settings. If you manually deny a device network access, and a situation later arises in which the device would be automatically granted access to the network, the device remains blocked. If you want to prevent a particular computer from connecting to the network in any circumstances, set it to Deny manually to prevent it from automatically being permitted network access at a later stage. For details about how to manually control network access, see 2.8.17 Manually controlling network access.

The following table describes the situations in which the features of JP1/IT Desktop Management 2 might automatically control the network access of a device.

Situation in which network access is controlled

Description

A device violates a security policy

If you define a security policy that denies network access to devices with a specific violation level in Action Items - Network Access Control, such devices are automatically blocked when assessed against the security policy. If the security status of a blocked computer later improves, it is judged as being compliant with the security policy and is automatically permitted network access again.

A hardware asset is added or edited

If you add a hardware asset in the Hardware Assets view of the Assets module that has an IP address or a MAC address, the device is registered in the network control list. If you change the IP address or MAC address in asset information, the change is reflected in the network control list. Network access is similarly permitted for imported hardware assets.

When a hardware asset is associated with a device, editing the hardware asset information does not result in changes to the network control list because IP addresses and MAC addresses are collected from the device.

Note that if you change the status of the hardware asset to Disposed or delete the hardware asset information altogether, the corresponding entry is removed from the network control list.

If you edit a MAC address in hardware asset information when the network control setting for the same MAC address already exists, the change is not applied to the network control list.

If automatic updating for only additions is enabled, the new setting is added while the network control settings before the change remain. In the remaining network control settings, Confirmation Choices is set for Automatic Updates Effect (Only Add Operations Enabled).

For details about how to set automatic updating, see the description of the procedure for editing the automatic update of the network filter list in the JP1/IT Desktop Management 2 Administration Guide.

A device enters the allowed time period for network access

If you permit a device to connect to the network within a specific time in the network control list, the device is automatically permitted network access when the specified start date/time arrives. When the end date/time arrives, the device is automatically blocked from the network again.

A discovered computer is designated as a management or exclusion target

When you designate a newly discovered computer as a management target or exclusion target, that computer is automatically granted network access. Even if network access is not permitted in a network segment, a discovered device that is designated a management or exclusion target is able to access the network.

However, when a device discovered in a search is automatically designated a management target, it is subjected to network access control according to the network monitor settings.

A new device connects to the network

When network monitor settings are assigned to a network segment, new devices that connect to the network are automatically subjected to network access control based on the network monitor settings.

Device information is updated or deleted

If the MAC address or IP address of a device changes as a result of an update to device information, the corresponding change is automatically made to the network control list#.

If automatic updating for only additions is enabled, the new setting is added while the network control settings before the change remain. In the remaining network control settings, Confirmation Choices is set for Automatic Updates Effect (Only Add Operations Enabled).

For details about how to edit the automatic update settings, see the description of the procedure for editing the automatic update of the network filter list in the JP1/IT Desktop Management 2 Administration Guide.

Information is updated for a network connection device

With all automatic updates enabled, the system determines that the network adapter information has been deleted and deletes the MAC address of the network adapter from the network control list (unless Not Permit is set) in the following cases:

The network is disabled (by, for example, disabling the local area connection by using My Network Places).

By setting the registry, it is possible to not delete MAC address of the network adapter from the network control list when disabling the network.

For information regarding the registry settings, refer to the explanation on controlling the network connections of devices in response to the evaluated security status of "JP1 Version 12 JP1/IT Desktop Management 2 Administration Guide.

The network cable is removed from the device.

A wireless LAN card is removed.

If automatic updating for only additions is enabled, the new setting of the network adapter is added while the network adapter settings before the change remain. In the remaining network adapter settings, Confirmation Choices is set for Automatic Updates Effect (Only Add Operations Enabled).

For details about how to edit the automatic update settings, see the description of the procedure for editing the automatic update of the network filter list in the JP1/IT Desktop Management 2 Administration Guide.

If the network adapter of a device is frequently disabled, register the device in the network control list with the following information:

Judgment Form: IP Address

MAC Address: Do not enter

IP address: The IP address of the device

Connection to Network: Permit

Fill in the other items as needed.

#: For details about the updates of the network control list, see 2.8.15 Automatic updating of the network control list.

Important

While the network monitor is disabled, changes are still made to the settings that determine whether a device has network access. However, devices are not subject to network access control. Changes only take effect when the network monitor is enabled again.

Tip

An event is generated when a device is denied or permitted network access. You can also configure the system to notify the administrator by email.

Related Topics:

2.9.4 Managing a security policy

2.11.2 Managing hardware asset information

2.8.8 Managing the network control list

2.8.15 Automatic updating of the network control list

When you add, update, or delete hardware information or device information, the network control list is automatically updated. The following describes update operations that are performed automatically.

If hardware asset information contains a MAC address or IP address that is not found in the network control list, information about the MAC address or IP address is added to the network control list.

If you change the status of the hardware asset to Disposed or delete the hardware asset information, the corresponding entry is removed from the network control list.

If you edit an IP address or MAC address in hardware asset information, the changes are applied to the network control list. However, if a hardware asset is associated with a device, editing the hardware asset information does not result in changes to the network control list because IP addresses and MAC addresses are collected from the device. If the network control setting for the same MAC address already exists, no changes are made in the network control list.

When device information contains a MAC address not found in the network control list, the MAC address and its IP address are added to the network control list. If the device that sent the device information has already been registered in the management server, the device is registered in the network control list with the permission status below. The permission status to be registered in the network control list is set according to the permission status of the device, as described in the following table:

Permission status of the device

Permission status in the control list

Allowed

Permit

Blocked

Not permit

Forced Blocking

Not permit

Not use period

Not permit

If the device that sent the device information has not been registered in the management server, the device is registered to the network control list with the following permission status. The permission status to be registered in the network control list is set according to the network monitor setting that is currently assigned to the network group to which the device's IP address belongs. The network monitor setting is displayed as the Discovered Nodes Option.

Network Monitor

Discovered nodes option

Permission status in the control list

Installed

Permit

Permit

Not Permit

Not Permit

Not Installed

Determined based on the settings in the network control settings file#

#: Determined based on the settings in the network control settings file. By default, the device with the "Permit" status is registered. For how to set the network control settings file, see the description of the procedure for editing the network control settings file in the JP1/IT Desktop Management 2 Configuration Guide.

If the most recently collected device information lacks a MAC address that was present in the previous set, the system assumes that the network card has been removed and deletes its MAC address information from the network control list. The MAC address is also removed from the network control list if the network card is disabled.

By setting the registry, it is possible to not delete MAC address of the network adapter from the network control list when disabling the network. For information regarding the registry settings, refer to the explanation on controlling the network connections of devices in response to the evaluated security status of "JP1 Version 12 JP1/IT Desktop Management 2 Administration Guide.

The system behavior when the IP address changes in the device information depends on the Judgment Form option selected in the Add Allow or Deny Network Access Permission dialog box or the Edit Network Connection Permission or Denial dialog box.

When the judgment form is MAC Address:

The IP address information for the device is changed in the network control list.

When the judgment form is IP Address or MAC Address + IP Address:

The device information in the network control list is left unchanged.

For this reason, we recommend that you select MAC Address as the judgment form in environments where IP addresses change frequently.

Tip

By default, automatic updating of the network control list is enabled only for additions of devices. If you upgrade JP1/IT Desktop Management 2 version 10-02 or earlier, all automatic updates (including additions, changes, and deletions) are enabled.

When automatic updating is enabled for only additions, the network control settings are retained without being changed or deleted (if you attempt to change the settings, new settings are added). In the remaining network control settings, Confirmation Choices is set for Automatic Updates Effect (Only Add Operations Enabled).

For details about how to set automatic updating, see the description of the procedure for editing the automatic update of the network filter list in the JP1/IT Desktop Management 2 Administration Guide.

2.8.16 Managing exclusive communication destinations for devices denied network access

By setting exclusive connection destinations, you can allow blocked devices to access specific devices on the network. For example, if you register a server that provides security measures in the Exclusive Communication Destination for Access-Denied Devices list, a device that is quarantined after being deemed a security risk can connect to the server to update its security. The management server is registered in the Exclusive Communication Destination for Access-Denied Devices list by default.

For computers on which the network monitor agent is installed, the environment is automatically configured as described below. Because this environment is a prerequisite for communication with exclusive communication destinations, do not change these settings.

Windows Firewall is disabled

The service (Routing and Remote Access) is enabled

When the OS is Windows Server 2012 or Windows Server 2008 R2, the Windows Routing and Remote Access role service is enabled.

To permit blocked devices to access specific devices on the network, create exclusive communication destination settings.

To change the devices that are accessible to a device that is blocked from the network, edit the exclusive communication destination settings.

If changes to the system mean that you no longer need an exclusive communication destination setting, delete the setting.

Fore details about managing exclusive communication destinations, see the description of managing special connections in the manual JP1/IT Desktop Management 2 Administration Guide.

2.8.17 Manually controlling network access

You can manually control network access while the network monitor is enabled.

Levels of priority apply to the network access control settings. If you manually deny a device network access, and a situation later arises in which the device would be automatically granted access to the network, the device remains blocked. If you want to prevent a particular computer from connecting to the network in any circumstances, set it to Deny manually. For details about how to manually control network access, see 2.8.14 Automatically controlling network access.

Tip

If you manually permit a device to access the network, and a situation later arises that automatically blocks the device, the manual setting is overruled and the device is denied network access.

You can use the following method to manually change a device's network access:

Controlling network access in the Inventory module or Security module

In the Device Inventory view of the Inventory module and the Computer Security Status view of the Security module, you can change the network connection status of individual devices.

Select the computer whose connection status you want to change in the information area, and from the Action menu, select Allow Connection or Deny Connection. The change takes effect immediately.

Controlling network access by using a command

By using a network control command provided by JP1/IT Desktop Management 2, you can block or enable network access of devices. The network control command can be executed from any environment other than that of the management server.

2.8.18 Importing the network connection information

By importing network connection information from a CSV file, you can add multiple entries to a network control list in a batch. You can also update multiple entries in a network control list, by exporting, editing, and then importing the network connection information. To import the network connection information, follow the Import the Network Connection Information wizard.

Tip

In a multi-server configuration, you can prepare a common set of network connection information for the whole system, and import the information to each management server. Doing so reduces the work required to configure a network control list on each management server. Sharing a set of network connection information among multiple management servers also comes in useful when you need to temporarily switch a server that manages computers, for going on a business trip for example. In this way, you do not have to review the network connection information each time you switch a managing server.

Tip

In the Network Filter Settings view of the Settings module, if a hyphen (-) is displayed for a field in the information area, the hyphen (-) is output as a null string when the network connection information is exported. This is done so that network connection information can be correctly imported when exported network connection information is imported without change.

Data in an imported CSV file must be in the defined formats. The following table describes the network connection information fields that can be imported and the defined formats.

Field

Format of data

Whether omission is possible

MAC Address

Write a hexadecimal string in one of the following formats (x: 0 to F):

xxxxxxxxxx

xx-xx-xx-xx-xx-xx

xx:xx:xx:xx:xx:xx

Note that hyphens (-) and colons (:) can be mixed as delimiters.

If there is data with a duplicate MAC address in a CSV file, an error occurs when the file is imported.

D#1

IP Address

Write in the following format:

nnn.nnn.nnn.nnn

Specify in the range from 0.0.0.0 to 255.255.255.255. You can specify only IPv4 IP addresses. If there is data with a duplicate IP address in a CSV file, and that data does not have MAC addresses specified, an error occurs when the file is imported.

D#1

Connection to Network:

Specify either 0 or 2:

0: Permits connection.

2: Denies connection.

N

Judgment Form

Specify one of 0, 1, and 2:

0: MAC address

1: IP address

2: MAC address + IP address

N

Specify duration

Specify either 0 or 1:

0: Do not specify a duration.

1: Specify a duration.

N

Start Date/Time

Specify the local time in a time zone of the Web browser in the following format:

YYYY-MM-DD hh:mm:ss

YYYY: year; MM: month; DD: date; hh: hour; mm: minute; ss: second

The import is performed after the specification of seconds is truncated to "00".

D#2

End Date/Time

Specify the local time in a time zone of the Web browser in the following format:

YYYY-MM-DD hh:mm:ss

YYYY: year; MM: month; DD: date; hh: hour; mm: minute; ss: second

The import is performed after the specification of seconds is truncated to "00".

D#2

Description

Specify any character string with no more than 128 characters.

Y

Legend: Y: The specification can be omitted. D: Depends on the value of another field. N: The specification cannot be omitted.

#1: Whether the specification can be omitted depends on the value of Judgment Form, as follows:

If Judgment Form is set to 0, MAC Address cannot be omitted.

If Judgment Form is set to 1, IP Address cannot be omitted.

If Judgment Form is set to 2, both MAC Address and IP Address cannot be omitted.

#2: If Specify duration is set to 1, specify Start Date/Time and End Date/Time. One of these fields can be omitted.

Behavior when data, whose Judgment Form is either MAC Address or MAC Address + IP Address, is imported

Behavior varies depending on whether the existing network control list has a network connection information entry which has the same MAC address with the one in the data to be imported.

If there is a network connection information entry which has the same MAC address

The relevant network connection information entry will be updated. In the updated network control list, Automatic Updates Effect (Only Add Operations Enabled) is set to No effect.

If there is no network connection information entry which has the same MAC address

A network connection information entry is newly added.

Behavior when data, whose Judgment Form is set to IP Address, is imported

Behavior varies depending on whether the existing network control list has a network connection information entry which has the same IP address as that in the data to be imported.

If there is a network connection information entry which has the same IP address

If the MAC address in the imported data and the MAC address of the relevant network connection information entry are different, a network connection information entry is newly added. Otherwise, the relevant network connection information is updated. In the updated network control list, Automatic Updates Effect (Only Add Operations Enabled) is set to No effect.

If there is no network connection information entry which has the same IP address

A network connection information entry is newly added.

Related Topics:

2.8.15 Automatic updating of the network control list

2.8.19 Exporting the network connection information

2.8.19 Exporting the network connection information

The network connection information can be exported to a CSV file. By exporting the information, you can share the configured network connection information with other management servers. By editing the exported network connection information and importing it, you can update the network control lists on multiple computers at the same time. You can export the network connection information from the Action menu of the Network Filter Settings view of the Settings module.

For details on the output data format, see the following link.

Related Topics:

2.8.18 Importing the network connection information

2.8.20 Network control function by linking with JP1/NETM/NM - Manager

Linking JP1/IT Desktop Management 2 with JP1/NETM/NM - Manager allows you to control network access without installing computers on which the network monitor is enabled.

To link with JP1/NETM/NM - Manager, you must install JP1/NETM/NM - Manager and a network control appliance. JP1/NETM/NM - Manager version 09-50 or later can be linked.

Linking with JP1/NETM/NM - Manager allows you to control network access by using the network control appliance, eliminating the necessity of installing or managing computers with the network monitor enabled in each site.

The following figure shows an overview of controlling the network by linking with JP1/NETM/NM - Manager.

JP1/IT Desktop Management 2 - Manager sends the network control list containing a list of access-permitted devices and a list of access-denied devices to JP1/NETM/NM - Manager. JP1/NETM/NM - Manager distributes the access-permitted device list and the access-denied device list to the network control appliance, which then controls network access of the network segment based on these lists.

Network access of devices managed by JP1/NETM/NM - Manager can be detected. However, unlike the network monitoring function of JP1/IT Desktop Management 2, devices in the network are not automatically discovered.

Because the following settings cannot be specified in JP1/IT Desktop Management 2, specify them in JP1/NETM/NM - Manager.

Environment setting of the network control appliance

Exclusive communication destinations for devices managed by JP1/NETM/NM - Manager

Related Topics:

4.4.13 JP1/NETM/NM - Manager linkage configuration

2.8.21 Network control function by linking with NX NetMonitor/Manager

Instead of JP1/NETM/NM - Manager, you can link with NX NetMonitor/Manager. The NX NetMonitor/Manager versions you can link with are 07-12 or later.

You can also link with NX NetMonitor/Manager packed with JP1 for IoT - NX NetMonitor 01-00 or later.

When you link with NX NetMonitor/Manager, replace "JP1/NETM/NM - Manager" described in this manual with "NX NetMonitor/Manager".

2.9 Managing security

There are various causes of problems related to computer security within an organization. (For example, if no anti-virus product is installed, if file share software is installed, or if the security settings for an OS are not sufficient.) To maintain a safe security status in an organization, you must define security rules for such causes, and have the computer users comply with those rules. Also, you must understand the security status, and take appropriate measures for problems as necessary.

Using JP1/IT Desktop Management 2, you can set security rules within an organization as a security policy, and apply it to each computer. By doing so, problems can be detected and the administrator notified, or automated countermeasures can be enforced.

By using a security policy, you can understand the following security statuses:

Whether updates are applied

Whether anti-virus products are applied

Whether mandatory software programs are installed

Whether prohibited software programs are installed

Operating status of services

Status of the OS settings

You can also configure various other settings regarding security management (for example, restrictions on the use of software programs or devices, or detection of suspicious operations on computers).

Important

An agent for UNIX is subject to the following limitations:

The Violation Level always becomes (Unknown) because security status judgment based on the security policy is not performed. Also, assessment of other statuses (such as OS patch application and anti-virus products configuration) is not performed.

Automatic countermeasure enforcement in response to a security-related problem (including automatic distribution of OS patches, anti-virus products, and mandatory software) cannot be performed. Also, e-mail notification cannot be performed.

Network connection cannot be automatically controlled. The network connection is manually controlled.

Distribution and application of OS patches or business-use software must be handled using Remote Install Manager.

Note that the number of days passed since the password was changed and the power-on password are notified as system information from an agent for UNIX. If notification is suppressed on the agent, OS patch information is not notified.

Important

An agent for Mac is subject to the following limitations:

Automatic countermeasure enforcement in response to a security-related problem (including automatic distribution of OS patches, anti-virus products, and mandatory software) cannot be performed. Also, e-mail notification cannot be performed.

Network connections can be automatically enabled or disabled based on a security status judgment.

Distribution and application of OS patches or business-use software must be handled using Remote Install Manager.

2.9.1 Managing security status

The following figure shows how the security status of a computer is managed.

First, define a security policy according to the security rules of an organization. JP1/IT Desktop Management 2 automatically assigns the default policy to managed computers. Therefore, you can judge the security status based on the default policy even if a new security policy has not yet been created. A recommended security policy (in which recommended security settings are defined) is also provided. For details about the default policy and the recommended security policy, see (3) Security policies provided by the product.

If you want to judge the security status based on a security policy other than the default policy, you need to add a security policy and assign it to the managed computers. After a security policy is assigned to a computer, the management server judges the security status of the computer based on the collected device information and the security policy. Also, prohibited operations are restricted and operation logs are collected on the managed computer. If automated countermeasures (Auto Enforce) are set, the countermeasures are enforced when the security policy is violated. For details about how to judge the security status, see 2.9.3 Judging security status. For details about how to restrict prohibited operations, see 2.9.5 Restricting prohibited operations.

The results of the security status judgment and the restriction of prohibited operations are notified to the management server, and the security status of the computer is displayed. The administrator must check the security status and take appropriate actions for solving problems. If automatic notification of messages is set in a security policy, messages are automatically sent to the managed computers according to the judgement results.

Operation logs are collected on the managed computers. Suspicious operations, judged based on the collected operation logs, are detected based on the security policy settings. The administrator can track suspicious operations through the operation logs, and check for information leakage. For details about tracking detected suspicious operations using operation logs, see 2.10.3 Investigating suspicious movements of files from systems using operation logs.

Important

When the security settings for computers within an organization are defined by a group policy for Active Directory, the settings take precedence over the security settings defined by a security policy for JP1/IT Desktop Management 2 even if automated countermeasures are set for the latter security settings.

Important

When you manage the security status of a virtual computer, install an agent on the virtual computer, as well as on the virtualization server.

Related Topics:

(1) Items that can be set for a security policy

2.9.2 Devices available for security management

In JP1/IT Desktop Management 2, security management is available only for management-target devices.

Note that whether or not a device is a management-target depends on whether an agent is installed on that device. The following table shows the devices for which security management is available.

Device type

OS type

Whether the security management functions can be executed

Security judgment

Automated countermeasures (Auto Enforce)

Actions

Message notification

Network control

Computer

Windows Server 2022

Y #1, #2

A#3, #6

A #3, #4, #6

Y

Windows Server 2019

Windows Server 2016

Windows 11

Windows 10

Windows 8.1

Windows 8

Windows Server 2012 R2

Windows Server 2012

Windows 7

Windows Server 2008 R2

Windows Server 2008

Windows Vista

Windows Server 2003 R2#5

Windows Server 2003#5

Windows XP

Linux

CentOS

Red Hat Enterprise Linux

Oracle Linux

N

N

N

Y

UNIX

AIX

HP-UX

Solaris

Mac OS

Y

N

N

Y

Chrome OS

N

N

N

N

Unknown

N

N

N

Y

Smart device

iOS or iPadOS

N

N

N

Y

Android

Storage

--

N

N

N

Y

Network device

Printer

Peripheral device

USB device

Display

Others

Device type added by the administrator

Unknown device

Legend: Y: Can be executed. A: Can be executed only on the devices on which an agent has been installed. N: Cannot be executed. --: Not applicable.

#1: The function is not supported if the edition of the OS is Unknown.

#2: Security judgment is not available for the computers that were selected as management targets via SNMP authentication and network search or Active Directory search. (The judgment result becomes Unknown.)

#3: The function can be executed only when the target computer is managed online. If the security policy is violated on a computer that is managed offline, manually take security measures.

#4: With the Citrix XenApp and Microsoft RDS server, message notification cannot be executed.

#5: Windows Server 2003 and Windows Server 2003 R2 are regarded as the same OS. For example, in Windows Update view (under Security Configuration Items) of the Edit Security Policy dialog box, if Windows Server 2003 Standard Edition is included in the specified group, the target OS includes Windows Server 2003 Standard Edition and Windows Server 2003 R2 Standard Edition.

#6: Automated countermeasures (Auto Enforce) and Message notification are not available for API-controlled devices.

2.9.3 Judging security status

Once a security policy is assigned to a managed computer, the security status of the computer is judged based on the security policy settings. During judgment, the management items in the security policy and the device information collected from the managed computer are compared and the violation level is judged.

In a multi-server configuration, each management server can assign security policies only to the computers that are directly under the management server. If the management servers are operated in a NAT environment, or if you want to use a common set of security policies among the management servers, specify the same policies to each management server.

Note that if message notification is set as an action item in a security policy, messages can be automatically sent to the computer depending on the results of the security status judgment. The messages notify of security problems. Therefore, the administrator can reduce the workload required to solve problems by directing users to take actions according to the messages.

Tip

When OS user accounts have been automatically created by some OS components or by certain programs, if the security statuses of unused user accounts are judged, you might not be able to manage the security status correctly. In such a case, you can exclude the unused user accounts from the judgment targets so that the security status can be judged appropriately.

(1) Violation levels judged by a security policy

If you define the judgment conditions and the countermeasures in a security policy and then assign the security policy to the managed computers, the violation level for security is judged based on the level of compliance with the security policy.

In a security policy, set the violation level (for each security judgment item) that will be displayed when the security status is judged as improper. If the security policy is not complied with, the judgment results in the violation level that has been set. The most severe violation level is displayed as the overall violation level of the computer.

The following table shows the types of violation levels in the order from the severe.

Violation level

Icon

Description

Critical

This is the most severe violation level.

This violation level is set when the extent of damage might extend to the whole system and it might have a significant impact on business, such as suspension of business, if an immediate action is not taken.

Important

This violation level is set when negligence of security measures for computers with security vulnerability might have a significant impact on the business.

Warning

This violation level is set when taking security measures will improve system safety even though the impact on business might not be significant.

Unknown

This violation level is set when the judgment results in one of the following:

Judgment of the security status has not yet been performed.

For agents that are connected to the network for the first time, judgment of the security status is not performed if security information has not been received from the agent by the time of the judgment of the security status. In such cases, the number of computers is not counted in the results of the judgment of the security level.

The security status cannot be judged because there is insufficient information.

In this case, you must install an agent on the computer and collect the necessary information so that the security status can be correctly judged.

The security status was not judged correctly.

In this case, the security status cannot be judged correctly because of an internal failure. You must investigate the cause of the failure and take appropriate action, referring to troubleshooting information, such as logs.

Computer running Linux or UNIX

In this case, judgement of the security status is not performed, and the Violation Level becomes always Unknown

Safe

This violation level is set when the computer complies with the security judgment items and judgment conditions.

Out of Target

None

This violation level is set when the judgment items for the security policy are not set.

This violation level is also set when the managed device is one of the following because judgment of the security policy is not performed for them:

Computer running an unknown OS

Computer with an unknown Windows edition

Judgment conditions for the violation level

The violation level is judged for security judgement conditions, security judgement items, and the computer.The following figure shows how the violation level is judged.

First, the violation level is judged for each security judgment item. If multiple security judgment conditions are set for a security judgment item, the violation level is judged for each judgement condition. The most severe security judgment condition result is determined to be the violation level of the relevant security judgment item.

Then the most severe security judgement item result is determined to be the violation level of the computer.

In this figure, judgment condition 2 of security judgment item 4 is judged as Critical, so security judgment item 4 is determined to be Critical, even though the other judgment conditions are judged as Safe. The computer is determined to be Critical because security judgment item 4 is judged as Critical even though the other judgement items are judged as Safe or Important.

For details about the security judgment conditions and security judgment items, see (1) Items that can be set for a security policy.

Note that you can check whether a computer complies with the security policy in the Computer Security Status view of the Security module.

Important

In the list of security policies, the application rate and the number of computers to which a security policy applies are calculated based on the number of devices for which the security status has been judged. Therefore, the application rate shows the ratio of the devices that comply with the security policy to the number of devices for which the security status has been judged by using the applicable security policy.

Regarding the number of computers to which a security policy applies, the displayed number of devices indicates devices for which the security status has been judged by using the applicable security policy. Devices for which the security status has not been judged even though they have been assigned a security policy are not included in the calculation of the application rate or the number of computers to which a security policy applies.

If "prohibited operations", "operation logs", or both are enabled in a security policy or if all of the judgment items set for the security policy have been removed from the judgment target, judgment of the security status will not be performed and the applicable devices will not be included in the calculation.

Counting the number of days regarding the violation level

The number of sequential days in which no security measures are taken is counted for each device. This information is used to send messages to users who have not taken security measures during a certain period of time, or to block the network connections for relevant devices.

The number of sequential days is incremented by 1 when 24 hours has passed since the time the violation level was judged as Critical, Important, or Warning. The following shows an example of counting the number of sequential days:

2011/4/1 0:00 to 2011/4/5 5:59: Judged as Critical.

2011/4/5 6:00 to 2011/4/7 12:00: Judged as Important.

In this case, JP1/IT Desktop Management 2 regards that no security measures were taken during the period from 2011/4/1 0:00 to 2011/4/7 12:00 (6 days and 12 hours). The number of sequential days in which no security measures were taken is counted as 7 days.

(2) Timing of security status judgment

The security status is judged on a periodic schedule. It is also judged when key device information is updated or changed.

The following table shows the details of security-status judgment conditions.

Timing

Security policy used for judgment

Computer to be judged

Description

A security policy is assigned.#1

Assigned security policy

All devices to which the security policy has been assigned

All devices that belong to the group to which the security policy has been assigned#2

Judgment is performed when a security policy is first assigned. It is also performed when and existing security policy is cancelled and a new security policy is assigned to a device or group.

The security policy is updated.#1

Updated security policy

All devices to which the updated security policy has been assigned

All devices that belong to the group to which the updated security policy has been assigned#2

Judgment is performed when the security policy is updated.

The system administrator updates asset information in the operation window or by using a command.#1

The priority order of the security policies is as follows:

Security policy assigned to the device

Security policy assigned to the group

Devices related to the assets whose asset information has been updated

If the added management item has been specified for at least one security policy as a user-defined security item, judgment is performed regardless of whether that security policy is used for judgement.

The system administrator changes the hardware asset assigned to the device.#1

The priority order of the security policies is as follows:

Security policy assigned to the device

Security policy assigned to the group

Devices whose association with hardware assets has been changed

If the added management item has been specified for at least one security policy as a user-defined security item, judgment is performed regardless of whether that security policy is used for judgement.

Device information for the managed computer is updated in the operation window.#1

The priority order of the security policies is as follows:

Security policy assigned to the device

Security policy assigned to the group

All devices whose device information has been updated

For online management:

Judgment is performed when the changed device information is collected on the management server and then updated.

For offline management:

Judgment is performed when the information collected from the computer by the information collection tool , or tool for applying policy offlineis reported to the management server.

The group to which the managed computer belongs is changed.#1

Security policy assigned to the new group

Devices whose group has been changed#2

If the target group type for the security policy is not a user-defined group:

Judgment is performed when the group to which the device belongs is changed, and a new security policy is assigned to the group.

If the target group type for the security policy is a user-defined group:

Judgment is performed when the user-defined group condition is changed for one of the following reasons:

The system administrator changed the user-defined group condition.

An added management item specified as the target item of a user-defined group is deleted.

An option of the added management items (whose data type is Emulation) specified as the target item of a user-defined group is deleted.

Periodical judgment (0:00 every day, by default#3)

The priority order of the security policies is as follows:

Security policy assigned to the device

Security policy assigned to the group

All devices

Judgment is performed according to the schedule specified in the Security Schedule view of the Settings module.

#1: If you enabled the large-scale management option when installing the management server, the security status is not judged at this time.

#2: If another security policy is directly assigned to a device, that security policy has priority for the device. Therefore, the device is excluded from this condition.

#3: If you enabled the large-scale management option when installing the management server, the default is set to 18:00 every day.

(3) Judging whether updates have been installed

To judge whether the latest updates have been installed on a computer, you must monitor the Microsoft website, determine whether it is necessary to apply judgment for new updates, and register the necessary information. These are troublesome tasks.

If you sign up for support services, the latest Windows Update information can be automatically acquired from the support service site regularly. The acquired Windows Update information is automatically applied to the security policy. Therefore, the administrator can judge whether the latest Windows Update information has been applied to the computer without the need of checking the versions of the updates. Also, depending on the security policy settings, you can distribute and apply the latest Windows Update information to the computers on which the latest updates have not yet been installed.

To automatically acquire the Windows Update information regularly, you must establish connection settings to the support service site and schedule settings for acquiring Windows Update information in the Settings module.

The following figure shows the flow from acquiring the latest Windows Update information to updating the security policy.

Tip

JP1/IT Desktop Management 2 can acquire the latest information about Critical or Important patches for security problems in Windows or Internet Explorer.

The status of whether updates have been installed is judged to be All updates are installed or Selected updates are installed. In the security policy, set the Windows Update information to be used when the security is judged.

Related Topics:

2.9.6 Managing Windows updates

(4) Judging whether the latest program updates have been installed

You can judge whether the latest program updates have been installed on a computer based on all the program update information registered in the management server. When program update information is added, the listed program updates are added to the judgment targets, so the status of whether the latest program updates have been installed is automatically acquired. You can also specify the program updates that are to be excluded from judgment.

The following table shows the information to be used for judgement.

Information

Description

Latest program update

The latest program update information acquired form the support service site. Specify this to install all program updates.

Note that, in the Update List view of the Security module, you can check the latest program updates acquired form the support service site.

Program updates to be excluded

Information about the program updates to be excluded from judgment. In the Security module, create a group for the program updates, and then specify that group when you set a security policy.

Device information

Information about the program updates collected from the computer to be judged based on the security policy.

When security is judged, the device information of the computers for which the security policy is applied is compared with the latest program update information acquired from the support service site. If both the document number and the security bulletin number do not match, it is judged that the latest program updates have not been installed, and the violation level defined in the security policy is set. If the program updates that are to be excluded from judgment have not been installed, a violation level is not set.

Tip

If the management server cannot connect to the support service site, connect to the support service site by using a computer that can connect to the external network, and then download the latest support information. If you manually copy the downloaded support information to the management server and then execute the updatesupportinfo command, you can register the latest information in the management server. In this way, you can apply the latest program update information to the management server.

Tip

Security judgment for cumulative updates and Security Monthly Quality Rollup for Windows is possible even when the latest update has been released but the update information posted on the support service site has not yet been updated. Security judgment can also be performed taking into consideration the grace period given to apply updates. For details, see the description of Judgment for cumulative updates and Security Monthly Quality Rollup for Windows in the manual JP1/IT Desktop Management 2 Administration Guide.

(5) Judging whether specified program updates have been installed

The status of whether the program updates have been installed on a computer can be judged based on the update information specified by the administrator. The administrator can specify service packs, versions, and updates for Windows, and service packs and updates for Internet Explorer.

The following table shows the information used for judgment.

Information

Description

Program updates specified by the administrator

Information about program updates judged to be dangerous if the service packs , versions, and program updates specified by the administrator have not been installed. In the Security module, create a group for the program updates, and then specify that group when you set a security policy.

Device information

Information about the program updates collected form the computers to be judged based on the security policy.

When the security is judged, the device information of the computers for which the security policy is applied is compared with the program update information specified by the administrator. If both the document number and the security bulletin number do not match, it is judged that the program updates specified by the administrator have not been installed, and the violation level defined in the security policy is set. In the same way, if information does not match when the device information of the computer is compared with the service pack or version information specified by the administrator, the system judges that the program updates specified by the administrator have not been installed, and the violation level defined in the security policy is set.

Related Topics:

(9) Managing update groups

(6) Judging the settings for automatic update

The following describes the information and judgement conditions used for judgement of the automatic update settings.

Information used for judgment

Items in the OS Security view (under Security Configuration Items)

Items in Update Details of the device information (security information)

Judgment conditions

Judgement is performed by comparing the device information with each item set for the security policy, and the violation level is determined depending on the judgment results.

If automated countermeasures are set (Auto Enforce), security measures are taken as necessary.

Related Topics:

(14) Supported anti-virus products

(7) Judging the security status for an anti-virus product

When the security status is judged for an anti-virus product, the status of the anti-virus product on each computer is compared with the latest versions of the virus detecting engine and virus definition file over all the computers to which the security policy is applied. Therefore, keep the version of the anti-virus product up to date on at least one managed computer.

However, the versions of anti-virus products on the computers within an organization are not always updated to the latest version at the same time. The latest version and an older version might coexist for a while. For this reason, you can set a grace period (which defines how many days the computer is allowed to stay in the older status) for the security policy.

The following figure shows the flow when judging whether the anti-virus product is up to date.

The security status of a device added as a managed device is judged based on the latest security policy settings. Therefore, if the following conditions exist, the security status is judged to be the violation level specified in the latest policy settings when the device is added as a managed device.

The grace period set for the judgment condition of an anti-virus product has expired and the security policy is updated.

After the security policy is updated in step 1, a device for which the security status for the anti-virus product is not up to date is added as a managed device.

Supported anti-virus products (anti-virus products to be judged)

For details about the anti-virus products supported by JP1/IT Desktop Management 2, see (14) Supported anti-virus products.

Information used for judgment

Items in the Antivirus Software view (under Security Configuration Items)

Antivirus Software Details of the device information (security information)

Judgment conditions

Judgment is performed by comparing the device information with each item set for the security policy. If all the items and the device information match, it is judged to be Safe. If there is a mismatch, it is judged as the corresponding violation level that has been set.

If automated countermeasures are set, security measures are taken as necessary.

Important

Multiple scan methods may be supported depending on the anti-virus product, in addition, the virus definition file version and engine version may vary depending on the scan method. Therefore, for managed device with multiple scan methods, the judging of newest virus definition file and engine version might not be performed properly. When using anti-virus product with multiple scan methods, unify the scan method used.

Related Topics:

(14) Supported anti-virus products

(8) Judging the security status for prohibited software

The following describes the information and the judgement conditions used for judgment of prohibited software.

Information used for judgment

Items for prohibited software (in Security Configuration Items)

Items in the device information (installed software information)

Judgment conditions

For prohibited software, the violation level is judged for each installed software program. If an information item set for prohibited software matches the name and version of an installed software program, the software program is judged to have the set violation level. If either of the name or version of an installed software program or both of them do not match any information items set for prohibited software, the software program is judged to be Safe. A software name is judged by partial match. A version is judged by Starts-with match.

Note that if prohibited software is not set in Security Configuration Items, the software program is judged to be Safe.

Important

If automated countermeasures are set, startup of the relevant software programs might be restricted or the software programs might be uninstalled. Multiple software programs might be the target of the automated countermeasures, because a software name is judged by partial match and a version is judged by Starts-with match.

Important

Do not specify a software program as both mandatory software and prohibited software when automated countermeasures are set. If you do so, the program will be alternately installed and uninstalled as the security judgments for mandatory software and prohibited software are implemented.

Important

If a software program that cannot be uninstalled is set as a prohibited software program in Programs and Features of the Windows Control Panel, uninstallation cannot be performed by automated countermeasures.

(9) Judging the security status for mandatory software

The following describes the information and the judgement conditions used for judgment of mandatory software.

Information used for judgment

Items in Software Use (under Security Configuration Items)

Items for OS information in the device information (system information)

Items in the device information (installed software information)

Judgment conditions

The judgment targets are the devices whose OS information (OS, and service pack or version) matches one set for mandatory software. For mandatory software, the violation level is judged for each installed software program. If an information item set for mandatory software matches the name and version of an installed software program, the software program is judged to be Safe. If either of the name or version of an installed software program or both of them do not match any information items set for mandatory software, the software program is judged to have the set violation level. A software name is judged by partial match. A version is judged by Starts-with match.

Note that if a mandatory program is not set in Security Configuration Items, the software program is judged to be Unknown.

If automated countermeasures are set, the relevant software programs might be installed as necessary.

Important

Do not specify a software program as both mandatory software and prohibited software when automated countermeasures are set. If you do so, the program will be alternately installed and uninstalled as the security judgments for mandatory software and prohibited software are implemented.

Important

If the OS itself is set as mandatory software, installation cannot be performed by automated countermeasures.

(10) Judging the security status for prohibited services

The following describes the information and the judgement conditions used for judgment of prohibited services.

Information used for judgment

Items in the Windows Services view (under Security Configuration Items)

Judgment conditions

The violation level is judged for each prohibited service set in the security policy, and determined by the judgment result. If the name of a running service matches a name registered as a prohibited service, the service is judged to have the violation level set in the security policy. If the name does not match, the service is judged to be Safe.

If automated countermeasures are set, the relevant service is stopped and disabled as necessary.

If no security policy is assigned to a computer managed offline, the service is judged to be Safe

(11) Difference of security judgment between different configurations for management

Whether individual configuration items for security judgment can be judged differs for agent-installed computers and an agentless computers. For agent-installed computers, it also differs for online management and offline management. For agentless computers, it also differs depending on the authentication method.

The following table shows whether judgment is available for individual configuration items for each configuration for management.

Configuration Item

Agent installed

Agentless

Windows

UNIX

Mac OS

Administrative Share

SNMP

ARP/ICMP

Active Directory

API

Windows

Mac OS

Other OS

Windows Update

Automatic Update

Y

N

Y

Y

N

N

N

Y

Y

N

All updates are installed

Y

N

N

Y

N

N

N

Y

N

N

Selected updates are installed

Y

N

N

Y

N

N

N

Y

N

N

Antivirus Software

Install

Y

N

N

Y

N

N

N

N

N

N

Scan Engine Version

Y

N

N

Y

N

N

N

N

N

N

Virus Definition File Version

Y

N

N

Y

N

N

N

N

N

N

Auto Protect

Y

N

N

Y

N

N

N

N

N

N

Last Scanned Date/Time

Y

N

N

Y

N

N

N

N

N

N

Software Use

Mandatory Software

Y

N

Y

Y

N

N

N

Y

Y

N

Unauthorized Software

Y

N

Y

Y

N

N

N

Y

Y

N

Windows Services

Y #1

N

N

N

N

N

N

N

N

N

OS Security

Guest Account

Y

N

Y

Y

N

N

N

Y

Y

N

Password Strength

Y

N

N

Y

N

N

N

Y

N

N

Password Never Expires

Y

N

N

Y

N

N

N

Y

N

N

Days Since Last Password Change

Y

N

Y

Y

N

N

N

Y

Y

N

Auto Logon

Y

N

Y

Y

N

N

N

Y

Y

N

Power On Password

Y

N

N

Y

N

N

N

Y

N

N

Password (Screen Saver)

Y

N

Y#2

Y

N

N

N

Y

Y

N

Startup Time (Screen Saver)

Y

N

N

Y

N

N

N

Y

N

N

Shared Folder

Y

N

N

Y

N

N

N

Y

N

N

Administrative Share

Y

N

N

Y

N

N

N

Y

N

N

Anonymous Access

Y

N

N

Y

N

N

N

Y

N

N

Firewall#3

Y

N

Y

Y

N

N

N

Y

Y

N

DCOM

Y

N

N

Y

N

N

N

Y

N

N

Remote Desktop

Y

N

N

Y

N

N

N

Y

N

N

User-Defined Security Settings

Y

N

Y

Y

N

N

N

Y

Y

N

Legend: Y: Can be judged. N: Cannot be judged.

Note: Automated countermeasures for security cannot be performed for an agent for UNIX or Mac, offline management, and agentless management.

#1: For offline management, the security settings for the services cannot be judged. If no security policy is assigned, the security status is judged to be Safe.

#2 For Mac OS, the judgement results indicate the results for all user accounts, instead of for each user account.

#3: The computers for which network monitor is enabled are not judged for Firewall.

Tip

For agentless computers, security judgment can be performed only by using authentication through Windows administrative share. Therefore, when you manage the security for an agentless computer, configure the computer so that authentication is performed through Windows administrative share.

Related Topics:

2.6.5 Agentless management

(12) Judging user-defined security settings

You can add any policy settings related to the computer's security settings as user-defined security settings to security policies. If you want to perform security judgment using conditions not provided by JP1/IT Desktop Management 2, add user-defined security settings.

When user-defined security settings are added, the security status of the computer is judged based on the specified judgment conditions. If action items are set in a security policy with user-defined security settings added, the system can send messages to the user and control network access based on the violation level indicated by the judgment result. You can view the judgment result of the security status in the Computer Security Status view of the Security module.

Overview of security judgment based on user-defined items

Judgment with the user-defined security settings is performed according to the target item, judgment conditions, and judgment value specified for a user-defined item. If the judgment conditions are satisfied, the security status of the device is judged as improper and the violation level changes to the value specified for Violation level. Note that a violation level other than Violation level can also be specified for devices for which the target item has no value.

Target item

The target item for the security judgment. If there are multiple data items for the target item, judgment is performed if at least one of them meets a judgment condition. The judgment result of the data item that first meets a condition will be displayed.

The target items you can select are system information in device information, hardware information in device information, and management items for hardware asset information added by the system administrator. For details about the target items that can be specified, see (1) Items that can be set for a security policy.

Judgment condition

The condition that the target item value compared with the judgment value must satisfy to judge the security status as improper.

Judgment value

The value that is compared with the value for the target item to determine whether the security status for the item is improper.

Important

The target items for user-defined security settings can be specified only from the added management items in the hardware asset information that system administrator has added. You cannot specify items provided by the system.

Example of setting the user-defined item

The following provides an example of setting the user-defined item to prohibit users with administrator permissions from logging on, and judge the security status to be Critical if a violation is detected.

User-defined item

Setting example

User-defined item name

Prohibit Administrator permission

Definition

Type of device information

System information

Target item

Name of the last logon user

Judgment condition

Equals the judgment value

Judgment value

Administrator

Action when target item has no value

Safe

Violation level

Critical

Judgment conditions and judgment values that can be specified for user-defined items

Judgment conditions and judgment values that can be specified for user-defined items vary depending on the data type of the target item. The following table lists the judgment conditions and judgment values that can be specified for each data type of the target item.

Data type of the target item

Judgment condition

Judgment value

Text

Equals the judgment value

Character string

The specified value is case sensitive. Single-byte characters are distinguished from double-byte characters during judgment.

Does not equal the judgment value

Contains the judgment value

Begins with the judgment value

Ends with the judgment value

Number

Equals the judgment value

Numbers from 0 to 9, and a decimal point (.)

The following units can also be used to specify a value.

B (byte)

KB (kilobyte)

MB (megabyte)

GB (gigabyte)

TB (terabyte)

PB (petabyte)

Minute

Does not equal the judgment value

Equal to or greater than the judgment value

Less than or equal to the judgment value

Greater than the judgment value

Less than the judgment value

Enumeration

Equals the judgment value

Values displayed in the pull-down menu

The specified value is case sensitive. Single-byte characters are distinguished from double-byte characters during judgment.

Does not equal the judgment value

Tip

When no value is entered in numerical target items (such as VRAM size or core clock speed) in the system information or hardware information, the value is dealt as 0. In such cases, the judgment result is not the risk level set for no value but the result judged between the judgment value and 0 under the judgment conditions.

(13) Security judgment for user accounts

When multiple user accounts are registered in an OS, some OS settings are defined for each user account. For certain setting items, the security status can be judged for each user account. This enables you to extract problematic user accounts (regarding security) and secure the computers.

The following items are judged for each user account:

Safety of the password

Number of days passed since the password was changed

Password protection for the screen saver

Waiting time before the screen saver starts

For these items, if all user accounts are in adequate status, the violation level of the device becomes Safe. If there is a problem with a user account, the violation level of the device changes to inadequate status. If the status is inadequate, the problematic user accounts are displayed in the Computer Security Status view (under the Security module). If automated countermeasures are set for a security policy, countermeasures are enforced only for the problematic user accounts.

Important

Security judgment is not performed for user accounts in either of the following statuses because password information cannot be collected for those user accounts:

Disabled user accounts

Locked-out user accounts

In addition, security judgment for the screen saver is not performed for the following user accounts because information about the screen saver cannot be acquired for those accounts:

User accounts that have not been logged in for 30 days or more since the last login

If message notification is set in Action Items for a security policy, a message prompting you to enforce countermeasures may be automatically displayed depending on the violation level. All user accounts receive the message. However, for the items that are judged for each user account, the description of the countermeasures is added only to the message for the problematic user accounts.

(14) Supported anti-virus products

JP1/IT Desktop Management 2 supports the anti-virus products shown below. The security status can be judged only for those anti-virus products.

Important

The products and versions shown below are the ones as of the release of the JP1/IT Desktop Management 2 product this manual covers.

You can check the latest information about supported anti-virus products on the support service site.

Tip

You can view the product versions shown below on the Installed Software Details tab of the Device Inventory view.

Tip

The security status cannot be judged for unsupported anti-virus products. However, whether a product has been installed can be judged if the product is registered as mandatory software in the security policy.

Anti-virus products for which information can be collected

Japanese versions of anti-virus products

Product name and version

Name displayed in the operation window

Norton AntiVirus#1, #2, #3

2005

Norton AntiVirus 2005

2006

Norton AntiVirus 2006

2007

Norton AntiVirus 2007

2008

32-bit

Norton AntiVirus 2008

64-bit

Norton AntiVirus 2008 64-bit

2009

32-bit

Norton AntiVirus 2009

64-bit

Norton AntiVirus 2009 64-bit

2010

32-bit

Norton AntiVirus 2010

64-bit

Norton AntiVirus 2010 64-bit

2011

32-bit

Norton AntiVirus 2011

64-bit

Norton AntiVirus 2011 64-bit

2012

32-bit

Norton AntiVirus 2012

64-bit

Norton AntiVirus 2012 64-bit

32-bit

Norton AntiVirus

64-bit

Norton AntiVirus 64-bit

2014

32-bit

Norton AntiVirus 2014

64-bit

Norton AntiVirus 2014 64-bit

Symantec AntiVirus Corporate Edition

10.0

32-bit

Symantec AntiVirus Corporate Edition 10.0

64-bit

Symantec AntiVirus 64-bit

10.1

32-bit

Symantec AntiVirus Corporate Edition 10.1

64-bit

Symantec AntiVirus 64-bit

10.2

32-bit

Symantec AntiVirus Corporate Edition 10.2

64-bit

Symantec AntiVirus 64-bit

Symantec Client Security

3.0

32-bit

Symantec Client Security

64-bit

Symantec AntiVirus 64-bit

3.1

32-bit

Symantec Client Security

64-bit

Symantec AntiVirus 64-bit

Symantec Endpoint Protection

11.0

32-bit

Symantec Endpoint Protection 11.0

64-bit

Symantec Endpoint Protection 11.0 64-bit

12.1 (12.1.4)

32-bit

Symantec Endpoint Protection 12.1

64-bit

Symantec Endpoint Protection 12.1 64-bit

12.1.5

32-bit

Symantec Endpoint Protection 12.1

64-bit

Symantec Endpoint Protection 12.1 64-bit

12.1.6 MP5

32bit

Symantec Endpoint Protection 12.1

64bit

Symantec Endpoint Protection 12.1 64bit

14.0

32bit

Symantec Endpoint Protection 14.0

64bit

Symantec Endpoint Protection 14.0 64bit

14.0.0 MP2

32bit

Symantec Endpoint Protection 14.0

64bit

Symantec Endpoint Protection 14.0 64bit

McAfee Total Protection Service#2, #3

5.0

McAfee Total Protection Service

McAfee SaaS Endpoint Protection#3

5.2

McAfee SaaS Endpoint Protection

6.0

32-bit

McAfee SaaS Endpoint Protection

64-bit

McAfee SaaS Endpoint Protection 64-bit

McAfee VirusScan Enterprise

8.5i

32-bit

McAfee VirusScan Enterprise 8.5i

64-bit

McAfee VirusScan Enterprise 8.5i 64-bit

8.7i

32-bit

McAfee VirusScan Enterprise 8.7i

64-bit

McAfee VirusScan Enterprise 8.7i 64-bit

8.8, 8.8 Patch 8

32-bit

McAfee VirusScan Enterprise 8.8

64-bit

McAfee VirusScan Enterprise 8.8 64-bit

McAfee Endpoint Security#2, #3, #4

10.1

32bit

McAfee Endpoint Security 10.1

64bit

McAfee Endpoint Security 10.1 64bit

10.2

32bit

McAfee Endpoint Security 10.2

64bit

McAfee Endpoint Security 10.2 64bit

10.5

32bit

McAfee Endpoint Security 10.5

64bit

McAfee Endpoint Security 10.5 64bit

ウイルスバスター

2011 クラウド#3

32-bit

ウイルスバスター 2011 クラウド

64-bit

ウイルスバスター 2011 クラウド 64-bit

2012 クラウド#3

32-bit

ウイルスバスター 2012 クラウド

64-bit

ウイルスバスター 2012 クラウド 64-bit

ウイルスバスター クラウド#3

32-bit

ウイルスバスター クラウド

64-bit

ウイルスバスター クラウド 64-bit

7.0

32-bit

ウイルスバスター クラウド 7.0

64-bit

ウイルスバスター クラウド 7.0 64-bit

8.0

32-bit

ウイルスバスター クラウド 8.0

64-bit

ウイルスバスター クラウド 8.0 64-bit

11.0

32-bit

ウイルスバスター クラウド 11.0

64-bit

ウイルスバスター クラウド 11.0 64bit

12.0#1

32bit

ウイルスバスター クラウド 12.0

64bit

ウイルスバスター クラウド 12.0 64bit

ウイルスバスター コーポレートエディション

8.0#3, 10.0#3, 10.5#5, 10.6, 11.0, 11.0 SP1 Critical Patch 6077, 11.0 SP1 Critical Patch 6206, XG Critical Patch 1440, XG SP1

32-bit

For the 32-bit version of Windows:

ウイルスバスター Corp.

For the 64-bit version of Windows:

ウイルスバスター Corp. 64-bit

64-bit

ウイルスバスター コーポレートエディション アドバンス

8.0#3, 10.0#3

32-bit

64-bit

ウイルスバスター コーポレートエディション サーバ版

8.0#3, 10.0#3

32-bit

64-bit

ウイルスバスター コーポレートエディション サーバ版 アドバンス

8.0#3, 10.0#3

32-bit

64-bit

ウイルスバスター ビジネスセキュリティサービス

5.7.1193

32-bit

ビジネスセキュリティサービス

64-bit

ビジネスセキュリティサービス 64-bit

Trend Micro ビジネスセキュリティ#3

6.0

32-bit

For the 32-bit version of Windows:

ビジネスセキュリティクライアント

For the 64-bit version of Windows:

ビジネスセキュリティクライアント 64-bit

64-bit

ウイルスバスター ビジネスセキュリティ#3

7.0

32-bit

64-bit

9.0, 9.0 SP3, 9.0 SP3 Critical Patch 4340, 9.5

32-bit

64-bit

ServerProtect for Windows NT/NetWare#6

5.7

32-bit

For the 32-bit version of Windows:

ServerProtect

For the 64-bit version of Windows:

ServerProtect 64-bit

64-bit

5.8

32-bit

64-bit

Forefront Client Security#3

1.5.1937.14, 1.5.1993.0, 1.5.1996.1

32-bit

Forefront Client Security

64-bit

Forefront Client Security 64-bit

Kaspersky Open Space Security Server#7

6.0.4

32-bit

Kaspersky Anti-Virus 6.0 for Windows Workstations

64-bit

Kaspersky Anti-Virus 6.0 for Windows Workstations 64-bit

Kaspersky Open Space Security Workstation#7

6.0.4

32-bit

Kaspersky Anti-Virus 6.0 for Windows Servers

64-bit

Kaspersky Anti-Virus 6.0 for Windows Servers 64-bit

Kaspersky Endpoint Security 8 for Windows#7

8

32-bit

For the 32-bit version of Windows:

Kaspersky Endpoint Security 8 for Windows

For the 64-bit version of Windows:

Kaspersky Endpoint Security 8 for Windows 64-bit

64-bit

8.1

32-bit

64-bit

Kaspersky Endpoint Security 10 for Windows#2, #7

10.2, SP1 (10.2.4.674)

32-bit

For the 32-bit version of Windows:

Kaspersky Endpoint Security 10 for Windows

For the 64-bit version of Windows:

Kaspersky Endpoint Security 10 for Windows 64bit

64-bit

ESET Endpoint Antivirus#1, #2, #3

5.0

32-bit

ESET Endpoint Antivirus

64-bit

ESET Endpoint Antivirus 64-bit

ESET File Security for Microsoft Windows Server#1, #2, #3

4.5

32-bit

ESET File Security for Microsoft Windows Server

64-bit

ESET File Security for Microsoft Windows Server 64-bit

ESET NOD32 Antivirus#1, #2, #3

4.0

32-bit

For the 32-bit version of Windows:

ESET NOD32 Antivirus

For the 64-bit version of Windows:

ESET NOD32 Antivirus 64-bit

64-bit

4.2

32-bit

64-bit

5.0

32-bit

64-bit

5.2

32-bit

64-bit

6.0

32-bit

64-bit

7.0

32-bit

64-bit

8.0

32-bit

64-bit

Sophos Endpoint Security and Data Protection

9.0

32-bit

For the 32-bit version of Windows:

Sophos Anti-Virus

For the 64-bit version of Windows:

Sophos Anti-Virus 64-bit

64-bit

9.5

32-bit

64-bit

Sophos Security Suite small business solutions

4.0

32-bit

Sophos Computer Security small business solutions

64-bit

Sophos Anti-Virus small business solutions

Sophos Endpoint Protection - Enterprise

10

32-bit

64-bit

Sophos Endpoint Protection - Advanced

32-bit

64-bit

Sophos Endpoint Protection - Basic

32-bit

64-bit

Sophos Endpoint Security and Control for Windows

10.3

32-bit

64-bit

10.3.7

32-bit

For the 32-bit version of Windows:

Sophos Anti-Virus 10.3.7

For the 64-bit version of Windows:

Sophos Anti-Virus 10.3.7 64-bit

64-bit

10.3.11

32-bit

For the 32-bit version of Windows:

Sophos Anti-Virus 10.3.11

For the 64-bit version of Windows:

Sophos Anti-Virus 10.3.11 64-bit

64-bit

10.3.13

32-bit

Sophos Anti-Virus 10.3.13

64-bit

Sophos Anti-Virus 10.3.13 64-bit

10.6.3.537, 10.7

32-bit

Sophos Anti-Virus 10

64-bit

Sophos Anti-Virus 10 64bit

F-Secure Client Security#1, #2, #3

9.0

32-bit

For the 32-bit version of Windows:

F-Secure Client Security

For the 64-bit version of Windows:

F-Secure Client Security 64-bit

64-bit

9.1

32-bit

64-bit

9.11

32-bit

64-bit

9.20

32-bit

64-bit

9.31

32-bit

64-bit

9.32

32-bit

64-bit

11.50

32-bit

64-bit

11.60

32-bit

64-bit

#1: The version of the virus search engine cannot be collected.

#2: The status for Auto Protect (resident setting) cannot be collected.

#3: The last scanned date and time cannot be collected.

#4: If you select the Threat Prevention option when installing McAfee Endpoint Security, security information can be acquired. However, information cannot be acquired immediately after McAfee Endpoint Security is installed. Also, the latest information cannot be acquired immediately after a McAfee Endpoint Security definition is updated. To acquire the latest information, after updating a McAfee Endpoint Security definition, restart the agent OS.

#5: The last scanned date and time can be collected only when Patch 1 or later has been applied.

#6: If the scan was canceled, the date and time the scan was canceled is collected as the last scanned date and time.

#7: If a complete scan is performed, the last scanned date and time can be collected only when all hard disks, system memory, and startup objects are scanned.

English versions of anti-virus products

Product name and version

Name displayed in the operation window

Norton AntiVirus#1, #2, #3

2010

32-bit

Norton AntiVirus 2010

64-bit

Norton AntiVirus 2010 64-bit

2011

32-bit

Norton AntiVirus 2011

64-bit

Norton AntiVirus 2011 64-bit

32-bit

Norton AntiVirus

64-bit

Norton AntiVirus 64-bit

Symantec AntiVirus Corporate Edition

10.0

32-bit

Symantec AntiVirus Corporate Edition 10.0

64-bit

Symantec AntiVirus 64-bit

10.1

32-bit

Symantec AntiVirus Corporate Edition 10.1

64-bit

Symantec AntiVirus 64-bit

10.2

32-bit

Symantec AntiVirus Corporate Edition 10.2

64-bit

Symantec AntiVirus 64-bit

Symantec Client Security

3.0

32-bit

Symantec Client Security

64-bit

Symantec AntiVirus 64-bit

3.1

32-bit

Symantec Client Security

64-bit

Symantec AntiVirus 64-bit

Symantec Endpoint Protection

11.0

32-bit

Symantec Endpoint Protection 11.0

64-bit

Symantec Endpoint Protection 11.0 64-bit

12.1

32-bit

Symantec Endpoint Protection 12.1

64-bit

Symantec Endpoint Protection 12.1 64-bit

12.1.4

32-bit

Symantec Endpoint Protection 12.1

64-bit

Symantec Endpoint Protection 12.1 64-bit

12.1.5

32-bit

Symantec Endpoint Protection 12.1

64-bit

Symantec Endpoint Protection 12.1 64-bit

12.1.6 MP5

32bit

Symantec Endpoint Protection 12.1

64bit

Symantec Endpoint Protection 12.1 64bit

14.0

32bit

Symantec Endpoint Protection 14.0

64bit

Symantec Endpoint Protection 14.0 64bit

14.0.0 MP2

32bit

Symantec Endpoint Protection 14.0

64bit

Symantec Endpoint Protection 14.0 64bit

McAfee Total Protection Service#2, #3

5.0

McAfee Total Protection Service

McAfee SaaS Endpoint Protection#3

5.2

McAfee SaaS Endpoint Protection

6.0

32-bit

McAfee SaaS Endpoint Protection

64-bit

McAfee SaaS Endpoint Protection 64-bit

McAfee VirusScan Enterprise

8.5i

32-bit

McAfee VirusScan Enterprise 8.5i

64-bit

McAfee VirusScan Enterprise 8.5i 64-bit

8.7i

32-bit

McAfee VirusScan Enterprise 8.7i

64-bit

McAfee VirusScan Enterprise 8.7i 64-bit

8.8, 8.8 Patch 7

32-bit

McAfee VirusScan Enterprise 8.8

64-bit

McAfee VirusScan Enterprise 8.8 64-bit

McAfee Endpoint Security#2, #3, #4

10.1

32bit

McAfee Endpoint Security 10.1

64bit

McAfee Endpoint Security 10.1 64bit

10.5

32bit

McAfee Endpoint Security 10.5

64bit

McAfee Endpoint Security 10.5 64bit

PC-cillin

2010

32-bit

PC-cillin 2010

64-bit

PC-cillin 2010 64-bit

Titanium Internet Security#3

2011

32-bit

Titanium Internet Security 2011

64-bit

Titanium Internet Security 2011 64-bit

2012

32-bit

Titanium Internet Security 2012

64-bit

Titanium Internet Security 2012 64-bit

2013

32-bit

Titanium Internet Security 2013

64-bit

Titanium Internet Security 2013 64-bit

2015

32-bit

Titanium Internet Security 2015

64-bit

Titanium Internet Security 2015 64-bit

2017

32-bit

Titanium Internet Security 2017

64-bit

Titanium Internet Security 2017 64bit

2018#1

32bit

Titanium Internet Security 2018

64bit

Titanium Internet Security 2018 64bit

Worry-Free Business Security-Standard

7.0#1, #2, #3, #5, 8.0#3, 9.0 SP3#3, 9.0 SP3 Patch 1#3 , 9.0 SP3 Critical Patch 4340#3, 9.5#3

32-bit

For the 32-bit version of Windows:

Worry-Free Business Security

For the 64-bit version of Windows:

Worry-Free Business Security 64-bit

64-bit

Worry-Free Business Security-Advanced

7.0#1, #2, #3, #5, 8.0#3, 9.0 SP3#3, 9.0 SP3 Patch 1#3 , 9.0 SP3 Critical Patch 4340#3 , 9.5#3

32-bit

64-bit

OfficeScan Corporate Edition

8.0#3, 10#3, 10.5#6, 10.6, 11.0, 11.0 SP1, XG , XG Critical Patch 1556, XG SP1

32-bit

For the 32-bit version of Windows:

OfficeScan Corp.

For the 64-bit version of Windows:

OfficeScan Corp. 64-bit

64-bit

ServerProtect for Windows NT/Netware

5.7

32-bit

For the 32-bit version of Windows:

ServerProtect

For the 64-bit version of Windows:

ServerProtect 64-bit

64-bit

5.8

32-bit

64-bit

Forefront Client Security#3

1.5.1937.14, 1.5.1993.0, 1.5.1996.1

32-bit

Forefront Client Security

64-bit

Forefront Client Security 64-bit

Kaspersky Open Space Security Server

6.0.3#1, #2, #3, 6.0.4#7

32-bit

Kaspersky Anti-Virus 6.0 for Windows Servers

64-bit

Kaspersky Anti-Virus 6.0 for Windows Servers 64-bit

Kaspersky Open Space Security Workstation

32-bit

Kaspersky Anti-Virus 6.0 for Windows Workstations

64-bit

Kaspersky Anti-Virus 6.0 for Windows Workstations 64-bit

Kaspersky Endpoint Security 8 for Windows#7

8, 8.1

32-bit

For the 32-bit version of Windows:

Kaspersky Endpoint Security 8 for Windows

For the 64-bit version of Windows:

Kaspersky Endpoint Security 8 for Windows 64-bit

64-bit

Kaspersky Endpoint Security 10 for Windows#2, #7

10.2, SP1 (10.2.4.674) , 10.3.0.6294

32-bit

For the 32-bit version of Windows:

Kaspersky Endpoint Security 10 for Windows

For the 64-bit version of Windows:

Kaspersky Endpoint Security 10 for Windows 64-bit

64-bit

ESET NOD32 Antivirus#1, #2, #3

4.0, 4.2, 5.0, 5.2

32-bit

ESET NOD32 Antivirus

64-bit

ESET NOD32 Antivirus 64-bit

ESET Endpoint Antivirus#1, #2, #3

6.5

32bit

ESET Endpoint Antivirus

64bit

ESET Endpoint Antivirus 64bit

Sophos Endpoint Security and Data Protection

9.0, 9.5

32-bit

For the 32-bit version of Windows:

Sophos Anti-Virus

For the 64-bit version of Windows:

Sophos Anti-Virus 64-bit

64-bit

Sophos Security Suite small business solutions

4.0

32-bit

Sophos Computer Security small business solutions

64-bit

Sophos Anti-Virus small business solutions

Sophos Endpoint Protection - Enterprise

10

32-bit

64-bit

Sophos Endpoint Protection - Advanced

10

32-bit

64-bit

Sophos Endpoint Protection - Basic

10

32-bit

64-bit

Sophos Endpoint Security and Control for Windows

10.3.7

32-bit

For the 32-bit version of Windows:

Sophos Anti-Virus 10.3.7

For the 64-bit version of Windows:

Sophos Anti-Virus 10.3.7 64-bit

64-bit

10.3.11

32-bit

For the 32-bit version of Windows:

Sophos Anti-Virus 10.3.11

For the 64-bit version of Windows:

Sophos Anti-Virus 10.3.11 64-bit

64-bit

F-Secure Client Security#1, #2, #3

9.0, 9.31, 9.32

32-bit

For the 32-bit version of Windows:

F-Secure Client Security

For the 64-bit version of Windows:

F-Secure Client Security 64-bit

64-bit

Avira Professional Security#2, #8, #9

14.0.4

32-bit

For the 32-bit version of Windows:

Avira Professional Security

For the 64-bit version of Windows:

Avira Professional Security 64-bit

64-bit

14.0.7

32-bit

64-bit

#1: The version of the virus search engine cannot be collected.

#2: The status for Auto Protect (resident setting) cannot be collected.

#3: The last scanned date and time cannot be collected.

#4: If you select the Threat Prevention option when installing McAfee Endpoint Security, security information can be acquired. However, information cannot be acquired immediately after McAfee Endpoint Security is installed. Also, the latest information cannot be acquired immediately after a McAfee Endpoint Security definition is updated. To acquire the latest information, after updating a McAfee Endpoint Security definition, restart the agent OS.

#5: The version of the virus definition file cannot be collected.

#6: The last scanned date and time can be collected only when Patch 1 or later has been applied.

#7: If a complete scan is performed, the last scanned date and time can be collected only when all hard disks, system memory, and startup objects are scanned.

#8: If you perform a Manual Update, the information is not updated. In a similar manner, the information is not updated in the case the version is the same as the Manual Update when you perform an downloaded update after performing a Manual Update.

#9: The information is updated when a scan is performed using one of the following profiles:

Local Drives

Local Hard Disks

Complete system scan

Chinese versions of anti-virus products

Judgment conditions for Auto Protect (resident setting ) of anti-virus products

You can collect the status of Auto Protect (resident setting) from most anti-virus products. The status of whether an anti-virus product is resident or non-resident is judged by the setting of the anti-virus product. The following shows the judgment conditions for whether anti-virus products are resident or non-resident.

Japanese versions of anti-virus products

Product name

Condition for judging whether the product is resident or non-resident

Norton AntiVirus

--

Symantec AntiVirus Corporate Edition

The product is resident when Enable Auto-Protect is on.

Symantec Client Security

Symantec Endpoint Protection

The product is resident when Enable File System Auto-Protect is on.

McAfee Total Protection Service

--

McAfee SaaS EndpointProtection

The product is resident when On-access scanning is enabled.

McAfee VirusScan Enterprise

The product is resident when Enable on-access scanning at system startup is on.

ウイルスバスター

The product is resident when ウイルス/スパイウェアの監視 is on.

ウイルスバスター 2011 クラウド

The product is resident when Real-time Scan is on.

ウイルスバスター コーポレートエディション

If Enable ウイルス/不正プログラム検索 (Enable Virus Scan for version 8.0, or Enable Real-time Scan for version 10.0) is set to off in Setting Real-time Scan on the management server running ウイルスバスター コーポレートエディション and then the settings are applied to the clients, real-time scan on the clients stops. At this time, the product becomes non-resident.

ウイルスバスター コーポレートエディション アドバンス

If Enable Real-time Scan (Enable Virus Scan for version 8.0) is set to off in Setting Real-time Scan on the management server running ウイルスバスター コーポレートエディション and then the settings are applied to the clients, real-time scan on the clients stops. At this time, the product becomes non-resident.

ウイルスバスター コーポレートエディション サーバ版

ウイルスバスター コーポレートエディション サーバ版 アドバンス

ビジネスセキュリティ

If リアルタイムのウイルス対策/スパイウェア対策を有効にする is set to off in the security settings and the settings are applied to a computer, real-time scan on the computer stops. At this time, the product becomes non-resident.

ServerProtect for Windows NT/Netware

If Enable Real-time Scan is set to off in Enable Real-time Scan on the information server and the settings are applied to general servers, real-time scan on general servers stops. At this time, the product becomes non-resident.

Forefront Client Security

The product is resident when Use real time protection is on.

Kaspersky Open Space Security Server

The product is resident when Enable protection is on.

Kaspersky Open Space Security Workstation

The product is resident when Enable protection is on.

Kaspersky Endpoint Security 8 for Windows

The product is resident when Pause of Pause protection and control is off.

Kaspersky Endpoint Security 10 for Windows

--

ESET Endpoint Antivirus

--

ESET File Security for Microsoft Windows Server

--

ESET NOD32 Antivirus

--

Sophos Endpoint Security and Data Protection

The product is resident when Execute on-access scanning for this computer is on.

Sophos Security Suite small business solutions

Sophos Computer Security small business solutions

Sophos Anti-Virus small business solutions

Sophos Endpoint Protection - Enterprise

Sophos Endpoint Protection - Advanced

Sophos Endpoint Protection - Basic

Sophos Endpoint Security and Control for Windows

F-Secure Client Security

--

Legend: --: The status of whether the product is resident or non-resident cannot be collected.

English versions of anti-virus products

Product name

Condition for judging whether the product is resident or non-resident

Norton AntiVirus

--

Symantec AntiVirus Corporate Edition

The product is resident when Enable Auto-Protect is on.

Symantec Client Security

Symantec Endpoint Protection

The product is resident when Enable File System Auto-Protect is on.

McAfee Total Protection Service

--

McAfee SaaS EndpointProtection

The product is resident when On-access scanning is on.

McAfee VirusScan Enterprise

The product is resident when Enable on-access scanning at system startup is on.

OfficeScan Corporate Edition

For version 8.0, 10, 10.5, or 10.5Patch1, the product is resident when Enable virus/malware scan is on. For version 10.6, if Enable virus/malware scan is set to off in Real-time Scan Settings on the management server and the settings are applied to client, real-time scan on client stops. At this time, the product becomes non-resident.

PC-cillin

The product is resident when Protection Against Viruses & Spyware is on.

Titanium Internet Security

Worry-Free Business Security-Standard

The product is resident when Enable real-time Antivirus/Anti-spyware is on (for version 8.0).

Worry-Free Business Security-Advanced

OfficeScan Corporate Edition

In versions 8.0, 10, 10.5, 10.5 Patch1, and 11.0, the product is resident when Enable virus/malware scan is on. For version 10.6, if Enable virus/malware scan is set to off in Real-time Scan Settings on the management server and the settings are applied to client, real-time scan on client stops. At this time, the product becomes non-resident.

ServerProtect for Windows NT/Netware

If Enable Real-time Scan is set to off in Real-time Scan on the information server and the settings are applied to general servers, real-time scan on general servers stops. At this time, the product becomes non-resident.

Forefront Client Security

The product is resident when Use real time protection is on.

Kaspersky Open Space Security Server

The product is resident when Enable File Anti-Virus is on (for version 6.0.3) or when Enable protection is on (for version 6.0.4).

Kaspersky Open Space Security Workstation

The product is resident when Enable File Anti-Virus is on (for version 6.0.3) or when Enable protection is on (for version 6.0.4).

Kaspersky Endpoint Security 8 for Windows

The product is resident when Pause of Pause protection and control is off.

Kaspersky Endpoint Security 10 for Windows

--

ESET NOD32 Antivirus

--

Sophos Endpoint Security and Data Protection

The product is resident when Enable on-access scanning for this computer is on.

Sophos Security Suite small business solutions

Sophos Computer Security small business solutions

Sophos Anti-Virus small business solutions

Sophos Endpoint Protection - Enterprise

Sophos Endpoint Protection - Advanced

Sophos Endpoint Protection - Basic

F-Secure Client Security

--

Avira Professional Security

--

Legend: --: The status of whether the product is resident or non-resident cannot be collected.

Chinese versions of anti-virus products

Tip

If you use an antivirus software product from Sophos, there might be a case that virus definition file versions differ depending on the update methods of virus definition files. As a result, the security judgment result for a virus definition file version might not be judged Safe even though the same virus definition file is applied. To avoid the problem, when using antivirus software products from Sophos and judging the security of a virus definition file version, make sure to update the virus definition files by using the same method on all devices where this security policy is applied.

Tip

If you have not upgraded the agents, the security judgment result for a virus definition file version of an anti-virus product from Sophos becomes Unknown. For anti-virus products from Sophos, to perform security judgment with the virus definition file version, upgrade the agents.

(15) Updating the information on the supported anti-virus products

Information on supported anti-virus products can be updated automatically, or by offline update. If you update the information on supported anti-virus products, the list of anti-virus products in the security policy becomes up to date, which allows you to select a new anti-virus product as the security policy judgment target.

After updating the information on the supported anti-virus products, either edit the existing security policies to correct selection of an anti-virus product as the judgement target, or create a new security policy and assign it to the computers.

Automatic update of the anti-virus products information

To automatically update information on anti-virus products, configure the Product Update view of the Settings module so that the device connects to the support service site. A support information file is automatically downloaded from the support service site after a certain period of time after a new anti-virus product is released, and the information on anti-virus products is updated. A support service contract is required to connect to the support service site.

Offline update of the anti-virus products

After manually downloading a support information file from the support service site, update the information on anti-virus products from the operation window, or by using a command offline. Use this method when the management server environment cannot connect to the support service site.

Offline update from the operation window

You can perform offline update from the Action menu in the Update List view of the Security module, the Managed Software view of the Assets module, and the Software Inventory view of the Inventory module.

Offline update by a command

You can perform offline update by executing the updatesupportinfo command.

(16) Excluding user accounts from security status judgment targets

If multiple user accounts are registered in an OS, the security status is judged for each user account for the following security configuration items:

Safety of the password

Password never expires

Number of days passed since the password was changed

Password protection for the screen saver

Waiting time before the screen saver starts

OS user accounts might be automatically created depending on the components of the OS or on certain programs. The security status might not be correctly managed if the security status is also judged for such unused user accounts.

In such a case, you can create a judgment-excluded user settings file so that certain user accounts will not be judged.

Tip

JP1/IT Desktop Management 2 automatically excludes some user accounts that are automatically created, from the judgment targets. If an unknown user account has been judged when you check the security status, create a judgment-excluded user settings file.

(17) Format of a user settings file excluded from security status judgment

Specify the file name as follows: jdn_except_users.dat.

After creating the file, place it in JP1/IT-Desktop-Management-2- Manager-installation-folder\mgr\conf.

Create a user settings file excluded from security status judgment in the following format:

OS user account name 1

OS user account name 2

Specify a single user account name for each line. To specify multiple user accounts, you can specify them by using multiple lines.

Leading and trailing single-byte spaces in user account names are ignored.

For a user account name, specify a character string not exceeding 20 single-byte characters, which can consist of alphanumeric characters and symbols. Note, however, that the following symbols cannot be used:

" / \ [ ] : ; | = , + * ? < >

In addition, you cannot specify a user account name by using only periods (.) or single-byte spaces.

Tip

You can use an asterisk (*) as a wildcard to specify all user account names for which the initial characters match the entered string, for example, HOGE*. You can specify an asterisk (*) only at the end of a character string. User account names consisting only of asterisks (*) are ignored.

2.9.4 Managing a security policy

In the Security Policies view of the Security module, create and manage a security policy. This subsection explains security policy management.

Create a security policy.

Create a security policy based on your organization's security principles. You can create multiple security policies. You can create a different security policy for each department or a security policy for computers that require special management.

You can generate a security policy that is applied to computers in an offline environment by selecting the Create Tool for Applying Policy Offline from Action in the Security Policies view. For details, see the description about the procedure for applying a security policy to offline-managed computers in the manual JP1/IT Desktop Management 2 Administration Guide.

Assign a security policy to computers.

To keep track of the security status of computers, you need to assign the created security policy to computers or groups.

Edit a security policy.

If the security trends change or your organization's security principles are changed, edit a security policy. Security trends change as the computers and the network environment change. By always incorporating security trends into your organization, you become able to robustly manage the security status.

Delete a security policy.

Delete security policies that are not needed anymore when the management structure has changed or when multiple security policies have been integrated.

Important

Agents for UNIX are excluded from security policy-based management. An automatic countermeasure is also not performed. Network connection control is manually performed.

Agents for Mac can be managed by using security policies. However, any detected problems cannot be corrected automatically. The network access control can enable or disable the access depending on the results of security status evaluation.

Computers in the offline environment are included in security-policy-based management. However, the security policy must be applied to the computers via an external storage medium. For details, see the description about the procedure for applying a security policy to offline-managed computers in the manual JP1/IT Desktop Management 2 Administration Guide.

(1) Items that can be set for a security policy

The following are the items that can be set for a security policy:

Security Configuration Items

Windows Update

You can judge whether automatic update has been executed properly and whether Windows updates have been installed properly. You can also configure the settings so that countermeasures are automatically enforced when the security status is inadequate.

Antivirus Software

You can judge whether anti-virus products have been properly installed or configured. This item is judged when information necessary for judgment can be collected from the computer.

Software Use

You can judge whether software programs have been properly installed. You can also configure the settings so that countermeasures are automatically enforced when the security status is inadequate.

Windows Services

You can judge whether certain services operate properly. You can also configure the settings so that countermeasures are automatically enforced when the security status is inadequate.

OS Security

You can judge whether the OS security settings (such as OS user accounts, screen saver, and share folders) are adequate. You can also configure the settings so that countermeasures are automatically enforced when the security status is inadequate.

User-Defined Security Settings

You can specify a policy related to the security settings to judge whether the security settings are appropriate based on user-specified conditions.

Other Access Restrictions

You can restrict print operations or the use of devices and software programs. You can also specify so that a user's computer receives a message notifying that the use of the device was restricted.

Operation Logs

You can set the targets for which operation logs are collected and the conditions for suspicious operations to be reported.

Common settings for prohibited operations and operation logs

You can set intervals for sending notification of prohibited operations and operation logs to the higher-level system, and the period for which prohibited operations and operation logs are kept on a user's computer.

Action Items

Send User Notification

You can configure the settings so that messages are automatically reported to computers depending on the results of security status judgments.

Network Connection Control

You can configure the settings so that network connection of the computer is automatically controlled depending on the results of security status judgment.

Assigned Groups

Target Group Type

You can set a group of computers to which a security policy is to be assigned. To assign a security policy to individual computers, first create a security policy, and then assign the security policy to the computers from the Computer Security Status view in the menu area.

The following table gives details about the items that can be set for a security policy.

Security Configuration Items

Configuration item

Description

Automated countermeasures

Windows Update

Automatic Update

You can judge whether automatic update is enabled.

To make sure that the latest Windows updates are installed, we recommend that you enable automatic update. By making sure that automatic update is enabled, you can make sure that the Windows updates are properly installed.

Y#1

All updates are installed

You can judge whether Windows updates have been installed.

By checking whether the updates have been installed, you can understand whether the OS status is latest and proper.

Y#14

Selected updates are installed

Antivirus Software

Install

You can judge whether an anti-virus product supported by JP1/IT Desktop Management 2 has been installed. If one of the products set in a security policy has been installed on a computer, the computer is judged to have a supported anti-virus product installed.

--

Scan Engine Version

You can judge whether the latest version of the anti-virus scan engine is being used.

You can set an update time limit, which is the period of time allowed after the latest version is detected and until the scan engine is updated. During the update time limit, even if an older version of the scan engine is used, the security status is judged as adequate.

Virus Definition File Version

You can judge whether the most up-to-date virus definition file is being used.

You can set an update time limit, which is the period of time allowed after the latest version is detected and until the virus definition file is updated. During the update time limit, even if an older version of the virus definition file is used, the security status is judged as adequate.

Auto Protect

You can judge whether the auto protect setting (resident setting) is enabled.

Last Scanned Date/Time

You can judge whether the last virus-scan date and time is within the specified number of days (scan time limit).

Software Use

Mandatory Software

You can judge whether specified software programs have been installed.

You can control your environment properly by making sure that the mandatory software programs defined in your organization have been installed. You can specify multiple mandatory software programs.

Y#14

Unauthorized Software

You can judge whether prohibited software programs have been installed.

By making sure that prohibited software programs, such as file sharing programs that are problematic for security, have not been installed, you can prevent information leakage. You can specify multiple prohibited software programs.

Y#15

Windows Services#2

You can judge whether prohibited services are operating. By checking whether prohibited services are operating in your organization, you can understand whether the computers are being used illegally.

You can specify multiple prohibited services. Judgment is made based on whether the specified services are operating.

Y#3

OS Security

Guest Account

You can judge whether there is a valid guest account.

If there is a guest account, everybody can use the computer. By making sure that no guest account can be used, you can prevent misuse of the computer.

Y

Password Strength#4

You can judge whether there is an account with a vulnerable password.

A vulnerable password might be easily decrypted. By making sure that no vulnerable password is set, you can prevent illegal accesses to the computer through decryption of the password.

--

Password Never Expires#4

You can judge whether there is an account with an indefinite password.

If the same password is used for a log time, it will become easier to decrypt. By making sure that no indefinite password is set, you can prevent illegal accesses to the computer through decryption of the password.

Y

Days Since Last Password Change#4

You can judge whether the number of days since the last password change exceeds the time limit.

If the same password is used for a long time, it will become easier to decrypt. By checking the number of days the password has been used, you can prevent illegal accesses to the computer through decryption of the password.

--

Auto Logon

You can judge whether auto logon is enabled.

If auto logon is enabled, anyone can start up and use the computer. By making sure that auto logon is not enabled, you can prevent illegal use of the computer.

Y

Power On Password

You can judge whether a power-on password is enabled, and whether the power-on password function is implemented.

By making sure that a power-on password is enabled, you can prevent illegal use of the computer.

--

Password (Screen Saver)#4

You can judge whether the screen saver is password protected.

If the screen saver is not password protected, the computer might be illegally used while the user is absent. By making sure that the screen saver is password protected, you can prevent illegal use of the computer.

Y#5

Startup Time (Screen Saver)#4

You can confirm that the screen saver starts within the specified time.

If the password protected screen saver has not yet been started, the computer might be illegally used while the user is absent. By checking the startup time of the screen saver, you can prevent illegal use of the computer.

Y#5, #6

Shared Folder

You can judge whether there are any shared folders.

Shared folders can allow illegal access to the computer. By making sure that shared folders are disabled, you can prevent illegal accesses to the computer.

Y

Administrative Share

You can judge whether administrative share is enabled.

If administrative share is enabled, the computer might be illegally accessed. By making sure that administrative share is disabled, you can prevent illegal access to the computer.

Y

Anonymous Access

You can judge whether anonymous access is enabled with no restrictions.

If anonymous access is enabled with no restrictions, the computer might be illegally accessed. By making sure that the anonymous access with no restrictions is disabled, you can prevent illegal accesses to the computer.

Y

Firewall #7, #8

You can judge whether Firewall is enabled, and whether it is implemented.

If Firewall is disabled, the computer might illegally accessed. By making sure that Firewall is enabled, you can prevent illegal accesses to the computer.

Y#1

DCOM

You can judge whether DCOM is disabled.

If DCOM is enabled, the computer might be illegally accessed. By making sure that DCOM is disabled, you can prevent illegal accesses to the computer.

Y

Remote Desktop#8

You can judge whether remote desktop is disabled, and whether it is implemented.

If remote desktop is enabled, the computer might be illegally accessed. By making sure that remote desktop is disabled, you can prevent illegal accesses to the computer.

Y#1

User-Defined Security Settings (System Information)

Host Name

You can specify the host name in computer information as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Computer Name

You can specify the computer name in computer information as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Description

You can specify the description of the computer in computer information as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Model

You can specify the model of the computer in computer information as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Computer Manufacturer

You can specify the manufacturer of the computer in computer information as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Computer UUID

You can specify the universally unique identifier (UUID) of the computer in computer information as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Computer Serial Number

You can specify the computer's serial number in computer information as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

CPU

You can specify the CPU in computer information as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Total Memory

You can specify the amount of memory in computer information as a judgment target item.

You can enter a number in the range from 0 to 9,223,372,036,854,775,807 (bytes) for the judgment value.

--

Total Free Space

You can specify the amount of free space on the hard disk in computer information as a judgment target item.

You can enter a number in the range from 0 to 9,223,372,036,854,775,807 (bytes) for the judgment value.

--

Number of Drives#9

You can specify the number of drives in System Drive information as a judgment target item.

You can enter a number in the range from 0 to 2,147,483,647 for the judgment value.

--

Drive Letter

You can specify the drive letter in System Drive information as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Total Free Space on Logical Drive

You can specify the amount of free space on the logical drive in System Drive information as a judgment target item.

You can enter a number in the range from 0 to 9,223,372,036,854,775,807 (bytes) for the judgment value.

--

Total Capacity of Logical Drive

You can specify the total capacity of the logical drive in System Drive information as a judgment target item.

You can enter a number in the range from 0 to 9,223,372,036,854,775,807 (bytes) for the judgment value.

--

Logical Drive File System

You can specify the file system for the logical drive in System Drive information as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Hard Disk Model

You can specify the model of the hard disk drive in System Drive information as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Total Capacity of Hard Disk

You can specify the total capacity of the hard disk drive in System Drive information as a judgment target item.

You can enter a number in the range from 0 to 9,223,372,036,854,775,807 (bytes) for the judgment value.

--

Hard Disk Interface

You can specify the interface for the hard disk drive in System Drive information as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

BIOS Name

You can specify the name of the BIOS in BIOS information as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

BIOS Manufacturer

You can specify the manufacturer of the BIOS in BIOS information as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

BIOS Serial Number

You can specify the serial number of the BIOS in BIOS information as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

BIOS Version (BIOS)

You can specify the version of the BIOS in BIOS information as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

BIOS Version (SMBIOS)

You can specify the version of the SMBIOS in BIOS information as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

AMT Firmware Version

You can specify the version of the AMT firmware as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Turn Off Monitor (AC)

You can specify, as a judgment target item, the length of time until the monitored power supply (AC) is turned off. This information is contained in Power Control information.

You can enter a number in the range from 0 to 2,147,483,647 (minutes) for the judgment value.

--

Turn Off Monitor (DC)

You can specify, as a judgment target item, the length of time until the monitored power supply (DC) is turned off. This information is contained in Power Control information.

You can enter a number in the range from 0 to 2,147,483,647 (minutes) for the judgment value.

--

System Standby (AC)

You can specify, as a judgment target item, the length of time until the system enters standby (AC) in Power Control information.

You can enter a number in the range from 0 to 2,147,483,647 (minutes) for the judgment value.

--

System Standby (DC)

You can specify, as a judgment target item, the length of time until the system enters standby (DC) in Power Control information.

You can enter a number in the range from 0 to 2,147,483,647 (minutes) for the judgment value.

--

Hibernation (AC)

You can specify, as a judgment target item, the length of time until the system goes into hibernation (AC) in Power Control information.

You can enter a number in the range from 0 to 2,147,483,647 (minutes) for the judgment value.

--

Hibernation (DC)

You can specify, as a judgment target item, the length of time until the system goes into hibernation (DC) in Power Control information.

You can enter a number in the range from 0 to 2,147,483,647 (minutes) for the judgment value.

--

Turn Off Hard Disks (AC)

You can specify, as a judgment target item, the length of time until the hard disk is turned off (AC) in Power Control information.

You can enter a number in the range from 0 to 2,147,483,647 (minutes) for the judgment value.

--

Turn Off Hard Disks (DC)

You can specify, as a judgment target item, the length of time until the hard disk is turned off (DC) in Power Control information.

You can enter a number in the range from 0 to 2,147,483,647 (minutes) for the judgment value.

--

Last Logged On User Name

You can specify, as a judgment target item, the user name of the last user who logged on in User Details.

You can enter 1 to 256 characters for the judgment value.

--

Last Logged On User's Account Name

You can specify, as a judgment target item, the domain name (or computer name) of the last user who logged on in User Details.

You can enter 1 to 256 characters for the judgment value.

--

Last Logged On User Description

You can specify, as a judgment target item, the description of the last user who logged on in User Details.

You can enter 1 to 256 characters for the judgment value.

--

OS

You can specify the OS in OS Details as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

OS service pack or version

You can specify the OS service pack or version as a judgment item.

You can enter 1 to 256 characters for the judgment value.

--

OS Serial Number

You can specify the serial number of the OS in OS Details as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

OS Owner

You can specify the owner of the OS in OS Details as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

OS Company Name

You can specify the company name for the OS in OS Details as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Windows Installer Version

You can specify the version number of Windows Installer in OS Details as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

IE Version

You can specify the IE version in OS Details as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

IE Service Pack

You can specify the IE service pack in OS Details as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Windows Update Agent Version

You can specify the version number of the Windows Update agent in OS Details as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Network Adapter

You can specify the network adapter in Network Details as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

MAC Address

You can specify the MAC address in Network Details as a judgment target item.

You can enter 1 to 17 characters for the judgment value.

--

Domain (Workgroup)

You can specify the domain (work group) in Network Details as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

User-Defined Security Settings (Hardware Information)

Number of Cores#9

You can specify the number of cores in Processor Details as a judgment target item.

You can enter a number in the range from 0 to 2,147,483,647 for the judgment value.

--

Processor

You can specify the processor in Processor Details as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Memory Capacity

You can specify the amount of memory in Memory Details as a judgment target item.

You can enter a number in the range from 0 to 9,223,372,036,854,775,807 (bytes) for the judgment value.

--

Memory Slot Capacity

You can specify the amount of memory in a memory slot in Memory Details as a judgment target item.

You can enter a number in the range from 0 to 9,223,372,036,854,775,807 (bytes) for the judgment value.

--

Virtual Memory Capacity

You can specify the amount of virtual memory in Memory Details as a judgment target item.

You can enter a number in the range from 0 to 9,223,372,036,854,775,807 (bytes) for the judgment value.

--

Number of Hard Disks#9

You can specify the number of hard disk drives in Hard Disk Details as a judgment target item.

You can enter a number in the range from 0 to 2,147,483,647 for the judgment value.

--

Hard Disk Model

You can specify the model of the hard disk drive in Hard Disk Details as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Hard Disk Capacity

You can specify the capacity of the hard disk drive in Hard Disk Details as a judgment target item.

You can enter a number in the range from 0 to 9,223,372,036,854,775,807 (bytes) for the judgment value.

--

Hard Disk Interface

You can specify the interface for the hard disk drive in Hard Disk Details as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Logical Drive Letter

You can specify the drive letter of the logical drive in Hard Disk Details as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Total Free Space on Logical Drive

You can specify the amount of free space on the logical drive in Hard Disk Details as a judgment target item.

You can enter a number in the range from 0 to 9,223,372,036,854,775,807 (bytes) for the judgment value.

--

Total Capacity of Logical Drive

You can specify the total capacity of the logical drive in Hard Disk Details as a judgment target item.

You can enter a number in the range from 0 to 9,223,372,036,854,775,807 (bytes) for the judgment value.

--

Logical Drive File System

You can specify the file system for the logical drive in Hard Disk Details as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Number of CD-ROM Drives#9

You can specify the number of CD-ROM drives in CD-ROM Drive Details as a judgment target item.

You can enter a number in the range from 0 to 2,147,483,647 for the judgment value.

--

CD-ROM Drive Model

You can specify the model of the CD-ROM drive in CD-ROM Drive Details as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Number of Removable Drives#9

You can specify the number of removable drives in Removable Drive Details as a judgment target item.

You can enter a number in the range from 0 to 2,147,483,647 for the judgment value.

--

Number of Printers#9

You can specify the number of printers in Printer Details as a judgment target item.

You can enter a number in the range from 0 to 2,147,483,647 for the judgment value.

--

Printer Name

You can specify the name of the printer in Printer Details as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Printer Driver

You can specify the printer driver in Printer Details as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Printer's Shared Name

You can specify the shared name of the printer in Printer Details as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Printer Server Name

You can specify the name of the printer server in Printer Details as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Printer Port

You can specify the printer port in Printer Details as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Number of Video Controllers#9

You can specify the number of video controllers in Video Controller Details as a judgment target item.

You can enter a number in the range from 0 to 2,147,483,647 for the judgment value.

--

Video Chip

You can specify the name of the video chipset in Video Controller Details as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

VRAM Capacity of Video Card

You can specify the amount of VRAM on the video card in VRAM Video Controller Details as a judgment target item.

You can enter a number in the range from 0 to 9,223,372,036,854,775,807 (bytes) for the judgment value.

--

Video Driver

You can specify the video driver in Video Controller Details as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Number of Sound Cards#9

You can specify the number of sound cards in Sound Card Details as a judgment target item.

You can enter a number in the range from 0 to 2,147,483,647 for the judgment value.

--

Sound Card Name

You can specify the name of the sound card in Sound Card Details as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Sound Card Manufacturer

You can specify the manufacturer of the sound card in Sound Card Details as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Number of Network Adapters#9

You can specify the number of network adapters in Network Adapter Details as a judgment target item.

You can enter a number in the range from 0 to 2,147,483,647 for the judgment value.

--

Network Adapter

You can specify the network adapter in Network Adapter Details as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Number of Monitors#9

You can specify the number of monitors in Monitor Details as a judgment target item.

You can enter a number in the range from 0 to 2,147,483,647 for the judgment value.

--

Monitor

You can specify the monitor in Monitor Details as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Number of Keyboards#9

You can specify the number of keyboards in Keyboard Details as a judgment target item.

You can enter a number in the range from 0 to 2,147,483,647 for the judgment value.

--

Keyboard

You can specify the keyboard in Keyboard Details as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Number of Mouse#9

You can specify the number of mouse in Mouse Details as a judgment target item.

You can enter a number in the range from 0 to 2,147,483,647 for the judgment value.

--

Mouse

You can specify the mouse in Mouse Details as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

User-Defined Security Settings (Added Management Item)

Added Management Item (Number)#9

You can specify an added management item whose data type is Number as a judgment target item.

You can enter a number in the range from -2,147,483,647 to 2,147,483,647 for the judgment value.

--

Added Management Item (Enumeration)

You can specify an added management item whose data type is Enumeration as a judgment target item.

You can select a judgement value from the pull-down menu.

--

Added Management Item (Text)

You can specify an added management item whose data type is Text as a judgment target item.

You can enter 1 to 256 characters for the judgment value.

--

Other Access Restrictions#2

Print suppression

You can restrict print operations.

You can also set a password to allow printing.

--

Suppression of the use of USB devices

You can restrict the use of USB devices.

--

Allow registered USB device usage#13

You can allow use of only the USB devices whose hardware asset information has been registered.

You can also use the following conditions to limit assets permitted to be used:

The department of the asset is the same as the department of the USB device.

The location of the asset is the same as the location of the USB device.

The asset is associated with the USB device.

--

Suppression of the use of built-in CD/DVD drives

You can restrict the use of built-in CD/DVD drives.

--

Suppression of the use of built-in FD drives

You can restrict the use of built-in FD drives.

--

Suppression of the use of IEEE1394 devices

You can restrict the use of IEEE1394 devices.

--

Suppression of the use of built-in SD cards

You can restrict the use of built-in SD cards.

--

Suppression of the use of Bluetooth devices

You can restrict the use of Bluetooth devices.

--

Suppression of the use of imaging devices

You can restrict the use of imaging devices.

--

Suppression of the use of Windows portable devices

You can restrict the use of Windows portable devices.

--

Display of suppression message#10

You can display a message indicating that the use of the device has been suppressed on the user's computer.

--

Suppression of write operation to removable disks

You can restrict only the write operation to removable disks.

--

Suppression of write operation to CD/DVD drives

You can restrict only the write operation to CD/DVD drives.

--

Suppression of write operation to FD drives

You can restrict only the write operation to FD drives.

--

Suppression of startup of software

You can restrict startup of one or more specified software programs.

--

Operation Logs#12

Target Operations to be Logged

You can set the operations for which operation logs are to be collected.

--

Send/Receive E-mail with Attachments

You can set whether sending or receiving email with attachments is regarded as a suspicious operation.

--

Use Web/FTP Server

You can set whether uploading files onto a Web server or an FTP server is regarded as a suspicious operation.

--

Copy/Move the File to External Device

You can set whether copying or moving files to external media is regarded as a suspicious operation.

--

Large Number of Printing Jobs

You can set whether submission of a large number of printing jobs (exceeding a defined value) is regarded as a suspicious operation.

--

Common settings for prohibited operations and operation logs#12

Intervals for sending notification of prohibited operations and operation logs to the higher-level system

You can set intervals for sending notification of prohibited operations and operation logs to the higher-level system.#11

--

Period for which prohibited operations and operation logs are kept on the user's computer

You can set a maximum time period for which prohibited operations and operation logs are kept on the user's computer before they are notified to the higher-level system.

--

Collect List of USB Device Files

You can set whether to obtain the list of files that are stored in the USB device in which hardware asset information is registered.

--

Legend: Y: Automated countermeasures can be set. --: Automated countermeasures are not supported.

#1: When Active Directory is used, if the computer settings are improperly set by a group policy, automated countermeasures will fail because the computer settings cannot be changed.

#2: Agentless computers are not supported.

#3: Automated countermeasures may fail because services that do not have the SERVICE_STOP permission or that depend on operating services cannot be stopped.

#4: When multiple user accounts are registered in the OS, this item is judged for each user account.However, for Mac OS, the judgement results indicate the results for all user accounts, instead of for each user account.

#5: Automated countermeasures are enforced only for the user accounts logged on to the OS.

#6: Automated countermeasures fail when the screen saver data is not placed in the Windows' System32 folder.

#7: When the agent OS is Windows Server 2003 without Service Pack, this item is not judged and automated countermeasures cannot be enforced. When the OS is Windows Server 2008 R2 or Windows 7 and multiple network cards are used, automated countermeasures are enforced for all network profiles.

#8: This item is not judged when the agentless OS is Windows Server 2003 without any Service Packs, Windows XP with Service Pack 1, Windows XP without any Service Packs, or Windows 2000.

#9: If it is not possible to determine if the value is unspecified or set to 0, the value is regarded as 0.

#10: For the Citrix XenApp and Microsoft RDS server, set the item not to be displayed because the item is not supported.

#11: Use the default setting of 60 minutes because setting a shorter notification interval might cause too much load on the higher-level system. You can use a shorter notification interval when you want to acquire operation logs earlier, for example, at the time of implementation.

#12: If you create a security policy for the offline-managed computers, do not change the default values for the configuration items.

#13: If you create a security policy for the offline-managed computers, you cannot enable the setting to limit the assets that can be used.

#14: If you create a security policy for the offline-managed computers, do not change the default values for the automatic enforcement settings.

#15: If you create a security policy for the offline-managed computers, do not change the default values for the Uninstall setting of the automatic enforcement.

Action Items

Item

Description

Send User Notification#

Messages can be automatically sent to the computer when the security status judged to be Critical, Important, or Warning.

You can create a notification message. The contents of the violation, as well as the notification message, are reported to the user.

Network Connection Control

You can allow or block the network connection of the computer based on the judgment result of the security status.

Note: Action items are executed only when the target computer connects to the management server.

Note: If you create a security policy for the offline-managed computers, do not change the default values for all the configuration items in Action Items.

#: For the Citrix XenApp and Microsoft RDS server, perform the setting so that a message is not notified because this item is not supported.

Assigned Groups

Item

Description

Target Group Type

You can specify the configuration of a group (OS, network, department, location, and user-defined) to which a security policy is to be assigned.

For the specified group configuration, you can set which group the security policy is to be assigned to.

(2) Notes on setting security policy

Computers managed offline and agentless computers are not subject to automated countermeasures.

When Restrict Reading/Writing for USB Device is enabled in a security policy, the device might be detected more than once by the operating system if USB device restriction occurred after the device has already been detected, causing the restriction message to appear repeatedly. To resolve this, disconnect the restricted USB device from the machine.

When Operations Logs are enabled and a computer's Power ON is specified as a target operation to be logged, the Operations Logs of a computer's power ON will be collected at the time of agent overwrite installation.

When an agent is installed in a SOFS (Scale-Out File Server) environment, the event 1066 of JP1/IT Desktop Management 2 might be intermittently output irregularly.

This phenomenon might occur when all of the following conditions are met:

An agent is installed on a SOFS environment.

There is a shared folder of SOFS.

Security Configuration Items - OS Security - Shared Folder of a security policy of JP1/IT Desktop Management 2 is enabled.

To avoid the phenomenon, disable Security Configuration Items - OS Security - Shared Folder of a security policy for the target host.

(3) Security policies provided by the product

JP1/IT Desktop Management 2 provides the following policies.

Default policy

This security policy is automatically assigned when no security policy is assigned to a managed computer.

Recommended security policy

This security policy is used to strengthen the security of an agent-installed computer. The security configuration items and action items that are recommended by JP1/IT Desktop Management 2 are set in the recommended security policy.

You can copy and use these policies when you create a new security policy.

Tip

If you have a support service contract and specified support information in Product Update of the settings window, the default policy and the update program information of recommended security policies and anti-virus products will be automatically updated, so that they are always the newest information.

The following table shows the values set for the default policy and the recommended security policy.

Configuration item

Violation level

Default policy

Recommended security policy

Setting

Automated countermeasures

Setting

Automated countermeasures

Windows Update

Automatic Update

Important

Y

N

Y

Y

All updates are installed

Important

Y

N

Y

Y

Selected updates are installed

Important

N

N

N

N

Antivirus Software

Install

Critical

E

--

E

--

Scan Engine Version

Critical

E (1 day)

--

E (1 day)

--

Virus Definition File Version

Critical

E (1 day)

--

E (1 day)

--

Auto Protect

Critical

E

--

E

--

Last Scanned Date/Time

Critical

E (7 days)

--

E (7 days)

--

Software Use

Mandatory Software

Critical

N

N

N

N

Unauthorized Software

Critical

N

N

N

N

Windows Services

Warning

N

N

N

N

OS Security

Guest Account

Important

Y

N

Y

Y

Password Strength

Warning

Y

--

Y

--

Password Never Expires

Warning

Y

N

Y

Y

Days Since Last Password Change

Warning

Y (180 days)

--

Y (180 days)

--

Auto Logon

Warning

Y

N

Y

Y

Power On Password

Warning

Y

--

Y

--

Password (Screen Saver)

Warning

Y

N

Y

Y

Startup Time (Screen Saver)

Warning

Y (10 minutes)

N

Y (10 minutes)

Y

Shared Folder

Important

Y

N

Y

Y

Administrative Share

Important

Y

N

Y

Y

Anonymous Access

Important

Y

N

Y

Y

Firewall

Important

Y

N

Y

Y

DCOM

Important

Y

N

Y

Y

Remote Desktop

Important

Y

N

Y

Y

User-Defined Security Settings

Critical

N

N

N

N

Other Access Restrictions

Print suppression

--

N

--

N

--

Suppression of the use of USB devices

--

N

--

Y

--

Allow registered USB device usage

--

N

--

Y

--

Acquire the stored list of files

--

N

--

Y

--

Suppression of the use of built-in CD/DVD drives

--

N

--

Y

--

Suppression of the use of built-in FD drives

--

N

--

Y

--

Suppression of the use of IEEE1394 devices

--

N

--

Y

--

Suppression of the use of built-in SD cards

--

N

--

Y

--

Suppression of the use of Bluetooth devices

--

N

--

Y

--

Suppression of the use of imaging devices

--

N

--

Y

--

Suppression of the use of Windows portable devices

--

N

--

Y

--

Display of suppression message (for USB devices)

--

N

--

Y

--

Display of suppression message (for devices other than USB)

--

N

--

N

--

Suppression of write operation to removable disks

--

N

--

N

--

Suppression of write operation to CD/DVD drives

--

N

--

N

--

Suppression of write operation to FD drives

--

N

--

N

--

Suppression of startup of software

--

N

--

Y

--

Operation Logs

Target Operations to be Logged

--

N

--

N

--

Send/Receive E-mail with Attachments

--

N

--

N

--

Use Web/FTP Serve

--

N

--

N

--

Copy/Move the File to External Device

--

N

--

N

--

Large Number of Printing Jobs

--

N

--

N

--

Common settings for prohibited operations and operation logs

Intervals for sending notification of prohibited operations and operation logs to the higher-level system

--

Y

--

Y

--

Period for which prohibited operations and operation logs are kept on a user's computer

--

Y

--

Y

--

Action Items

Send User Notification

--

N

--

Y (Critical, Important, Warning)

--

Legend: Y: Enabled. E: Enabled for anti-virus products for which information can be collected. N: Disabled. --: Not supported.

Related Topics:

(1) Items that can be set for a security policy

(4) Assigning a security policy

To judge security status, you must assign a security policy to a group or a computer. The following describes the ranges to which a security policy can be assigned.

Tip

The default policy is automatically assigned immediately after a computer is set as a management target.

Assigning a security policy:

If you assign a security policy to a computer, that security policy is then applied to the computer. If you assign a security policy to a group, the security policy is applied to all computers that belong to that group and its subordinate groups.

If different security policies are assigned to a computer and the group to which the computer belongs, the security policy assigned to the computer is applied. If a security policy is directly assigned to a group, that security policy is applied to the group. In this case, even if another security policy is assigned to the upper group, the security policy assigned to the upper group is not applied to the subordinate group.

Note that the assigned security policy remains applied even if the computer is switched from online management to offline management.

Important

A computer might be registered with multiple IP address groups (for example, when multiple network interface cards are used in the computer). If a computer is registered in multiple groups for which different security policies are assigned, the default policy is applied to the computer.

The following figure shows an example of the range of assignment when a security policy is assigned.

In the above figure, security policy A is assigned to computer PC01 and group B. However, security policy B is applied to computer PC03 in group B because security policy B has been directly assigned to computer PC03.

Cancelling assignment of a security policy:

You can cancel an assigned policy. If a security policy assigned to a group is cancelled, the security policy assigned to the upper group will be applied. If no security policy is assigned to the upper group, the default policy will be assigned.

The following figure shows an example of the range of assignment when a security policy is cancelled.

In the above figure, the security policies assigned to computers PC01 and PC03 are cancelled. The default policy will be applied to PC01 because no security policy is assigned to upper group A. Security policy A, which is assigned to upper group B, will be applied to PC03.

(5) Action items related to security judgment

If a security policy is assigned to a managed computer, the security status will be judged. You can configure the settings for the target computer so that certain actions (such as message notification or network control) are automatically taken depending on the results of the security status judgment.

The following action items can be executed depending on the judgment result of the security status:

Send User Notification

You can create messages to notify the users of the results of security status judgments. If you set the violation level to be notified of and the conditions for notification, you will be able to send the users notification messages only when the violation level is Critical () or when the dangerous security status continues for more than a specified number of days. Note that only the computers managed online can receive messages.

For details about how to use notification messages, see (6) Notification messages depending on the security status.

Network Connection Control

You can set how to change the status of a computer's network connection based on the results of a security status judgment. If you set the violation level that is used for determining connection control and the conditions for rejecting connections, you will be able to block network connections of the computers whose violation level is Important (), or to control the network connection when the dangerous security status continues for more than a specified number of days.

For details about how to control network connections, see (9) Blocking or allowing network access depending on the judgment result of a security policy.

(6) Notification messages depending on the security status

You can send notification messages to computers whose security status is problematic. Only the computers managed online can receive notification messages. You can report messages in either of the following ways:

In the Device List view (under Computer Security Status) of the Security module, you can send a message any time you want.

Automatically send messages that were set in advance, depending on the results of the security policy judgment.

Tip

You can also send notification messages from the Device List view (under Device Inventory) of the Inventory module.

If a message is sent to a managed computer from the management server, a pop-up window appears on the user's screen, so the user can view the message. Note that only the latest message can be viewed.

Important

If notification by a message fails, the message will be re-sent only once. If notification by a message fails twice, the message will no longer be sent.

(7) Contents of an automatically reported message

The following shows example contents of an automatically reported message:

Item

Description

Message body

Displays the text specified for the Message Body of the Message Contents in the Send User Notification view (under Action Items of Security Policies ).

Violation level

Displays the following character strings depending on the violation levels corresponding to the judgment results:

Safe: Safe

Warning: Warning

Important: Important

Critical: Critical

Not enough information: Unknown

Error: Unknown

Not performed: Unknown

Out of target: Out of Target

AAAA

Displays the name of the user account that was judged as Critical.

BBBB

Displays the description of the items that were judged as Critical among the items in the OS Security view of the user account that was judged as Critical. The following contents are displayed:

Your Password is not strong.

Your Password from Last Password Change expired.

Password (Screen Saver) is disabled.

Startup Time (Screen Saver) is invalid.

CCCC

Displays the message Automatic Windows Update is disabled. when Windows automatic update is disabled.

DDDD

Displays the Windows updates that were found not have been installed by the Windows Update judgment. The following shows the display formats:

With the article ID: security-information-ID(article-ID)

Without the article ID: security-information-ID

With the service pack name or version name: product-name (service-pack-name or version-name)

Note that information that exceeds 5,000 bytes cannot be output. The number of updates that cannot be output is displayed in the form of Other: n.

EEEE

Displays the names and versions of the prohibited software programs that were found to have been installed by the Software Use judgment. The following shows the display formats:

With the version number: software-name version

Without the version number: software-name

Note that information that exceeds 6,000 bytes cannot be output. The number of prohibited software programs that cannot be output is displayed in the form of Other: n.

FFFF

Displays the names and versions of the mandatory software programs that were found not have been installed by the Software Use judgment.

With the software name and version: software-name version

With the software name only: software-name

Note that information that exceeds 6,000 bytes cannot be output. The number of programs that cannot be output is displayed in the form of Other: n.

GGGG

Displays the service display names of the services that were found to be in use by the Windows Services judgment.

If information exceeds 6,000 bytes and some services cannot be displayed, the number of the services that cannot be displayed is displayed in the format of Other: n.

HHHH

Displays descriptions of the items that were judged to be Critical in the judgment of the items in the OS Security view. The following contents are displayed:

Enabled Guest Account exists.

Password Never Expires for some accounts. account name

Your Password is not strong. account name

Your Password from Last Password Change expired. account name

Auto Logon is enabled.

Power On Password is disabled or not implemented.

Shared Folder is enabled.

Anonymous Access is enabled.

Windows Firewall is disabled.

Administrative Share is enabled.

DCOM is enabled.

Remote Desktop is enabled.

Password (Screen Saver) is disabled. account name

Startup Time (Screen Saver) is invalid. account name

IIII

Displays a user-defined item that was determined as Critical as a result of judgment based on the user-defined security settings.

(8) Character strings that can be embedded in automatic notification messages

The following character strings can be embedded in the message body of automatic notification messages.

Character string

Display contents

%judgedate%

The date and time the security status was judged.

%contdays%

The number of days the inadequate status continued.#1

%refusedmsg%

The device has been disconnected.

Your computer will be refused to connect to a network in n days.#2

#1: Displayed when Notification Option is set in the Send User Notification view (under Action Items of Security Policies).

#2: Displayed when Disconnect Condition is set in the Network Connection Control view (under Action Items of Security Policies).

(9) Blocking or allowing network access depending on the judgment result of a security policy

You can block the network access of a computer when the judgment result of a security policy for the computer exceeds the violation level that has been set. If the judgment result returns to a level lower than the set violation level, the network access will be automatically allowed. If you want to block or allow network access of a computer, the network segments to which the target computer belongs must be monitored.

Tip

You can also select the target computer in the Device List view (under Device Inventory) of the Inventory module, and then block or allow network access from the Action menu. For details, see 2.8.17 Manually controlling network access.

Priority of the network access control

The manual setting takes priority over the automatic network access control.

When a computer is manually set so that network access is not allowed:

Network access is not allowed even when the conditions for automatically allowing network access are satisfied.

If some computers must not access the network, manually set those computers so that network access is not allowed.

(10) Countermeasures for security policy violations

When a computer violates a security policy, take actions so that the settings of the computer will be adequate. Using JP1/IT Desktop Management 2, you can enforce automated countermeasures or forced countermeasures in response to a security policy violation.

Automated countermeasures

If you set automated countermeasures for a security policy, the settings of a computer that violated the security policy can be automatically changed to an adequate status. For details, see (11) Automated countermeasures against security policy violations.

Forced countermeasures

You can forcibly enforce countermeasures for each computer that violated a security policy when you want. If you want to enforce forced countermeasures to a computer, an agent for online management must be installed on that computer.

(11) Automated countermeasures against security policy violations

When a computer violates a security policy, you need to check and change the settings of the computer so that the security status becomes adequate. Repeating such jobs requires great care.

If you set automated countermeasures, when a computer violates a security policy, countermeasures are automatically taken so that the security status of the computer becomes adequate. Thus, the administrator can keep the computers in an organization in a safe security status without the need of caring for the settings of individual computers.

Automated countermeasures that can be set for a security policy:

Enable Windows automatic update.

When Windows automatic update is disabled, the following operations are performed:

Important updates is set to Install updates automatically, which is displayed in the Control Panel by selecting Windows Update and Change settings.

The startup type of the Windows Update service is set to Automatic.

The Windows Update service is started.

When Windows updates included in the mandatory update group have not been installed, forcibly execute Windows automatic update or automatically distribute the updates.

Windows automatic update is executed forcibly or the update is distributed automatically when the Windows update included in the mandatory update group has not been installed. Executing Windows automatic update forcibly installs not only mandatory updates but also other updates.

When mandatory software programs have not been installed, install the software programs.#

When prohibited software programs have been installed, restrict startup of the software programs.

When prohibited software programs have been installed, uninstall the software programs.#

When prohibited services are running, stop and disable the services.

If prohibited services are running, they are stopped and disabled. Note that a prohibited service cannot be sopped when another service that depends on the prohibited service is running.

Disable the guest account.

Cancel the setting of a password that never expires.

Cancel auto logon.

Set password protection for the screen saver.

If the password protection for the screen saver is not enabled, the protection is set to enabled when the user logs in.

Change the wait time for starting the screen saver when the value exceeds a predefined value.

If the wait time for starting the screen saver exceeds a predefine value, the wait time is changed to a specified value in a security policy when the user logs in.

Remove shared folders.

If there are any shared folders, they are unshared. This might cause a shared printer to be unshared and users might no longer be able to use the printer.

Cancel anonymous access with no restrictions.

Enable Windows Firewall.

Remove an administrative share.

Disable DCOM.

Enable Distributed COM on this computer is cleared in the Default Properties tab of the My Computer Properties dialog box, which is displayed by executing dcomcnfg and then selecting Component Services. This might cause applications that use DCOM to fail. You must perform appropriate tests before you configure automated countermeasure options.

Disable remote desktop.

#

For Windows Store apps, you can set installation or uninstallation for automated countermeasures but the actual installation or uninstallation will not be performed. If you want to install or uninstall a Windows Store app, perform the operation individually on the target computer.

Time when countermeasures are automatically enforced

When a security policy is assigned.

When a security policy is updated.

When a group to which managed computers belong is changed.

When the device information of the managed computers is updated.

Countermeasures are automatically enforced at the above times depending on the security policy settings. Both security configuration and automated countermeasures for services are enforced on the managed computers. As for installation of mandatory software programs and installation of prohibited software programs, the distribution function is executed from the management server.

Important

For the items below, countermeasures are automatically enforced after a computer to which a security policy is assigned is restarted. After the security policy is applied to the computer, balloon tips are displayed regularly to prompt the user to restart the computer. Whether balloon tips are displayed depends on the specification in the User notification settings view for the agent configuration.

Execute Windows Update

Anonymous Access

Windows Firewall #

Administrative Share

DCOM

Remote Desktop

#: Only when the OS on the computer is Windows Server 2008, Windows 7, or Windows Vista.

Related Topics:

(1) Items that can be set for a security policy

(12) Notes on automated countermeasures against security policy violations

If security countermeasures are automatically enforced or a security policy is applied, you cannot change the settings of the managed computers back to the state before the countermeasures were taken even if you use the JP1/IT Desktop Management 2 functions. For the following items, the JP1/IT Desktop Management 2 functions cannot change the settings back to the state before the countermeasures were taken:

Windows Update

Software Use

Windows Services

OS Security

(13) Notes for forcible countermeasures for a violation of security policies

To install update programs by selecting "Install Updates" for a countermeasure item and "Automate Updates" for countermeasure contents to execute security countermeasures, it is necessary that all of the following conditions are met:

The setting of the group policies of Windows is either of the following:

In the group policies of Windows, automatic updates for Windows Update are not configured.

In the group policies of Windows, automatic updates for Windows Update are configured and the setting to automatically install update programs is enabled in the configuration of automatic updates.

The following service is running:

Background Intelligent Transfer Service

2.9.5 Restricting prohibited operations

You can set a security policy so that some computer operations will be restricted. By doing so, you can prevent information leakage.

Important

The restriction of prohibited operations is not available for API-controlled devices.

Restricting printing

You can restrict print operations. This can help you prevent information (for internal use only) from being taken out in printed form.

You can set a password for allowing printing. This will let you restrict the users who are allowed print operations to those that you disclose the password to.

Important

You cannot restrict output to a printer connected via the Internet. You cannot restrict output to a local printer when using a File port or a LAN Manager port. Also, you might not be able to restrict output to a Windows network shared printer.

When the printing function is used to output a file such as a PDF file, the file might be output even if a message indicating that the printing is restricted appears on the user's computer.

Suppression of Device Usage

You can restrict usage of a device. This prevents information from being taken out via the device. Use of the following devices can be restricted:

USB devices (normal USB devices)

USB devices (USB devices that are recognized as UASP-enabled devices in Windows 8 and later)

Built-in CD/DVD drives

Built-in FD drives

IEEE1394 devices

Built-in SD cards

Bluetooth devices

Imaging devices

Windows portable devices

You can display a message indicating that use of a device is restricted on the user's computer.

If you restrict the use of USB devices, you can permit the use of some registered USB devices or limit assets that can use the USB device based on the department, location, or associated asset. You can also create a list of files stored on the USB devices.

In addition, you can restrict only the writing operation to the following devices:

Removable disks

CD/DVD drives

FD drives

Write-only restrictions can only be applied to permitted devices.

Tip

The write restrictions are enabled after the computer to which a security policy is assigned restarts. After a security policy is applied to a computer, balloon tips regularly appear, prompting the user to restart the computer. Whether balloon tips are displayed depends on the specification in the User notification settings view for the agent configuration.

Restricting startup of software programs

You can block the startup of the software programs that might cause information leakage (for example, file sharing software or messenger software).

You can block the startup of software programs with the following extensions:

exe

com

scr

Note that if the character string made up of the execution file name and the folder name has 260 or more characters, startup of the software program cannot be blocked.

Important

If a software program finishes its processing immediately after it starts up, startup of the program might not be blocked because it might finish before it is blocked.

Important

Do not block startup of the execution files related to the OS and JP1/IT Desktop Management 2. If you block startup of such execution files, the OS or JP1/IT Desktop Management 2 might not operate properly.

Important

If 16-bit software is used, you cannot block the startup of the software program.

Important

If an agent's OS is Windows 7, suppression on the use of devices, printing restriction and collection of operation logs cannot be performed on Windows XP Mode.

(1) Devices whose use can be restricted

By setting prohibited operations in a security policy, you can restrict the use of devices on an agent-installed computer.

The following table shows the devices whose use can be restricted, and conditions for the deterrence targets.

Tip

Devices which have been accessed by a user before the security policy settings are enabled are not subject to the restriction.

Devices that can be restricted

Condition for the deterrence targets#1#6

USB devices (normal USB devices)

Devices to which data can be stored via USB connection#2.

The target devices must satisfy the following two conditions when connected:

The device must be displayed under a USB controller in Device by type in the Device Manager window.

The device must be displayed under one of the Disk drives, DVD/CD-ROM drives, or Floppy disk drives in the Device Manager window.

In addition, the enumerator of a device that is displayed under one of the Disk drives, DVD/CD-ROM drives, or Floppy disk drives in the Device Manager window must be USBSTOR.

USB devices (USB devices that are recognized as UASP-enabled devices in Windows 8 and later)

Devices to which data can be stored via USB connection#2

The target devices must satisfy the following two conditions when connected:

The device must be displayed under USB Attached SCSI (UAS) Mass Storage Device in the Storage controllers in the Device Manager window.

The service displayed for the device must be UASPStor.

The device must be displayed under one of the Disk drives, DVD/CD-ROM drives, or Floppy disk drives in the Device Manager window.

The enumerator displayed for the device must be SCSI.

Built-in CD/DVD drives

The target devices are CD/DVD drives built in a computer.

These drives are displayed under DVD/CD-ROM drives in Device by type in the Device Manager window. The enumerator of the DVD/CD-ROM drive must be IDE or SCSI.

Built-in FD drives

The target devices are FD drives built in a computer.

These drives are displayed under Floppy disk drives in Device by type in the Device Manager window. The enumerator of the floppy disk drive must be FDC.

IEEE1394 devices

The target devices are the devices connected to the computer with IEEE1394#3.

These drives are displayed under Disk drives in Device by type in the Device Manager window. The enumerator of the disk drive must be SBP2.

Built-in SD cards

The target devices are SD cards connected to the computer via a built-in SD card slot#3.

A device other than an SD card connected via the SD card slot might be regarded as a built-in SD card and subject to restriction.

These drives are displayed under Disk drives in Device by type in the Device Manager window. The enumerator of the disk drive must be SD or RIMMPTSK, or PCISTOR.

Note that an SD card slot that is built in a computer but uses a USB controller might not be regarded as a built-in SD card.

Bluetooth devices

The target devices are Bluetooth devices connected to the computer via USB.

These drives are displayed under Bluetooth in Device by type in the Device Manager window. The enumerator of the Bluetooth must be USB, and the class of the device must be BTW or BTM.

Imaging devices

The target devices are imaging devices connected to the computer via USB#4.

These devices are displayed under Imaging Devices in Device by type in the Device Manager window. The enumerator must be USB.

Windows portable devices

The target devices are Windows portable devices connected to the computer#5.

These devices are displayed under Portable Devices in Device by type in the Device Manager window.

#1: The displayed items might differ depending on the OS settings and other configurations.

#2: The target devices are devices that have one of the following device setup classes:

Class

ClassGuid

CDROM

{4d36e965-e325-11ce-bfc1-08002be10318}

DiskDrive

{4d36e967-e325-11ce-bfc1-08002be10318}

FloppyDisk

{4d36e980-e325-11ce-bfc1-08002be10318}

The Class and ClassGuid device setup classes are, in Windows 7, the text string displayed by opening the properties of the device from the Device Manager window, clicking the Details tab, and selecting Device class or Device class guid from the pulldown menu.

If you cannot find the Class and ClassGuid device setup classes, ask the developer of the device.

#3: The target devices are devices that have one of the following device setup classes:

Class

ClassGuid

DiskDrive

{4d36e967-e325-11ce-bfc1-08002be10318}

The Class and ClassGuid device setup classes are, in Windows 7, the text string displayed by opening the properties of the device from the Device Manager window, clicking the Details tab, and selecting Device class or Device class guid from the pulldown menu.

If you cannot find the Class and ClassGuid device setup classes, ask the developer of the device.

#4: The target devices are devices that have one of the following device setup classes:

Class

ClassGuid

Image

{6bdd1fc6-810f-11d0-bec7-08002be2092f}

The Class and ClassGuid device setup classes are, in Windows 7, the text string displayed by opening the properties of the device from the Device Manager window, clicking the Details tab, and selecting Device class or Device class guid from the pulldown menu.

If you cannot find the Class and ClassGuid device setup classes, ask the developer of the device.

#5: The target devices are devices that have one of the following device setup classes:

Class

ClassGuid

WPD

{eec5ad98-8080-425f-922a-dabf3de3f69a}

The Class and ClassGuid device setup classes are, in Windows 7, the text string displayed by opening the properties of the device from the Device Manager window, clicking the Details tab, and selecting Device class or Device class guid from the pulldown menu.

If you cannot find the Class and ClassGuid device setup classes, ask the developer of the device.

#6: Regardless of the device's outer shape, judgment of the restricted device is performed based on whether the device, as recognized by Windows, matches the condition.

Related Topics:

(3) Types of USB devices that can be allowed for use

(7) Notes on restricting the use of devices

(2) Devices on which only the write operations can be restricted

In prohibited operation settings in the security policy, only write operations can be restricted on an agent-installed computer. You must restart the computer after you change the write restriction security policy.

The following table shows the devices on which only write operations can be restricted, the relevant device type, and conditions for the deterrence targets.

Device

Example applicable device#1

Condition for the deterrence targets#2

Removable disk

USB-connected hard disk

USB-connected flash memory (such as USB memory device and USB-connected card reader)

IEEE1394-connected hard disk

The target drives include a drive whose drive type is displayed as Removable Disk in Windows Explorer, and a drive whose drive type is displayed as Local Disk in USB or IEEE1394 connections.

The target includes both the built-in drives and USB or IEEE1394-connected drives.

CD/DVD drive

USB-connected CD/DVD drive

Built-in CD/DVD drive

The target drives are drives that are displayed under DVD/CD-ROM drives in Device by type in the Device Manager window. The target includes both the built-in drives and USB-connected drives.

FD drive

USB-connected FD drive

The target drives are drives that are displayed under Floppy disk drives in Device by type in the Device Manager window.

The target includes both the built-in drives and USB-connected drives.

#1: If an applicable device is recognized by the OS as a different device, the device is treated according to the OS recognition and not subject to the write-operation restriction.

#2: The displayed items may vary depending on the OS settings or other configurations.

Tip

Write operation to DVD-RAM might not be restricted.

If a tool tries to access a device under write-operation restriction, the tool might encounter an error, or an event or error dialog box may appear.

If write-operation restriction is enforced, some devices including encryption-supported USB devices, might not be started or used.

By writing restriction of CD/DVD, it might not be able to suppress the write operation to CD/DVD by the third-party software. In order to prevent file transfering by these softwares, please use Blocking startup of software of prohibited-operation suppression function, and block startup of third-party softwares.

Devices on which write operations can be restricted differ depending on the OS. The following table shows the relationship between the restricted devices and the OSs.

Device

Windows 8.1, Windows 8

No edition

Windows 10, Windows 8.1, Windows 8

Pro, Enterprise

Windows Server 2019, Windows Server 2016, Windows Server 2012

Windows 7, Windows Server 2008, Windows Vista

Windows Server 2003

Windows XP (Service Pack 2 or later)

Removable disk

N

Y #1, #2

Y#1, #2

Y #1

N

S#4

CD/DVD drive

N

Y #1, #2

Y#1, #2

Y #1

S#3

S#3

FD drive

N

Y #1, #2

Y#1, #2

Y #1

N

N

Legend: Y: Can be restricted. S: Some devices might not be restricted. N: Cannot be restricted.

#1: The Windows service, Portable Device Enumerator Service, must be set to Manual or Automatic.

#2: Writing operation will not be restricted if a USB device is assigned to a memory pool.

#3: Whether the write operation can be restricted or not depends on the writing software. Only software programs that support Windows IMAPI are subject to restriction.

#4: USB devices, including USB-connected hard disks, CD/DVD drives, and FD drives, can be restricted.

When the use of USB devices are restricted

If write restriction for CD/DVD drives, FD drives, or removable disks is set on a computer that restricts the use of USB devices, enabled restriction item and JP1/IT Desktop Management 2 behavior vary depending on the registration status of the connected device. The following table describes the details.

Behavior when USB-connected hard disks, CD/DVD drives, FD drives are connected to a computer that is set to restrict the use of USB devices

Restriction item

Registration status of a connected device (USB device)

Behavior of JP1/IT Desktop Management 2

Write restriction of CD/DVD drive, removable disk, or FD drive

Not registered

Read and write operations are restricted (a restriction event is sent, and a restriction message is displayed).

Registered

Write operation is restricted.

Related Topics:

(3) Types of USB devices that can be allowed for use

(7) Notes on restricting the use of devices

(3) Types of USB devices that can be allowed for use

When the use of USB devices has been restricted by the setting of prohibited operations in a security policy, you can configure the settings so that only USB devices registered as hardware assets are allowed for use.

Tip

The device instance ID (which is acquired when a USB device is registered) is used for identifying a USB device. The device instance ID is an ID set to a USB device. Some USB devices have unique IDs that can be identified individually, and other USB devices have IDs that change depending on the connecting ports or environments.

You can allow the use of the following two types of USB devices:

USB devices that can be allowed for individual devices

The USB devices that have unique device instance IDs can be allowed for use for individual devices.

Note that, when you display the Details tab of the device properties (from the Windows Device Manager) and select Capabilities from the pull-down menu, the USB devices that have unique IDs are displayed as CM_DEVCAP_UNIQUEID.

USB devices that can be allowed for individual products

The USB devices whose device instance IDs change depending on the connecting ports or environments can be registered and allowed for use for individual products. For example, if you have multiple USB memory devices of the same model of the same manufacturer, and if the device instance IDs for those USB memory devices are not unique, registering one of those devices allows the use of all of those devices.

A USB device whose device instance ID may change is identified based on a part of the ID. If the beginning part of the device instance ID for a USB device matches the registered device instance ID (which was specified when another USB device was registered), the two devices are regarded as the same product. Note that for a USB device that can be allowed for use for individual products, a message is displayed when the USB device is registered.

You can use the following conditions to limit assets that can use the USB device based on the hardware asset information items of the USB device:

The department of the asset is the same as the department of the USB device.

The location of the asset is the same as the location of the USB device.

The asset is associated with the USB device.

With these conditions configured, you can specify USB devices to be allowed for use for each department, location, or asset (device).

Important

Use a computer managed online to register USB devices to be allowed for use.

Important

If you have registered a USB device to be allowed for each product, another device of the same product is treated as the same hardware asset when it is registered. Therefore, if the use of USB devices is restricted in a security policy, the use of USB devices is allowed for individual products.

Important

When a device has multiple ways for connecting to a computer (for example, connecting interfaces and modes), the device might be identified differently depending on the connection method.

Important

To allow the use of a USB device that connects to a computer via multiple devices, you must allow the use of all the devices on the connection path.

Important

When you connect a device with no device instance ID to a computer, the OS generates an arbitrary device instance ID. The device instance ID for such a device changes depending on the connecting computer or port, so the use of the device might not be allowed.

Tip

If you connect a USB device that has already been registered and is individually identified to a computer managed offline, information about the files stored in the USB device is collected. The collected information is displayed on the Title File List tab of the Hardware Assets view (of the Assets module). Note that the Title File List tab is displayed only when the Device Type is USB Device. However, if acquisition of a list of files is prohibited by the security policy, Title File List displays a message that a file list cannot be acquired.

(4) Notes on when prohibited operations are restricted

The following are notes on individual restriction targets when you set a policy for prohibited operations in a security policy.

Related Topics:

(5) Notes on restricting startup of software

(6) Notes on restricting printing

(7) Notes on restricting the use of devices

(5) Notes on restricting startup of software

The total characters for the file name and folder name of the software program to be restricted must be less than 260 characters.

If a software program finishes its processing immediately after it starts up, startup of the program might not be blocked because it might finish before it is blocked.

If the same software program is restricted by JP1/IT Desktop Management 2 and another program, that software program might not be restricted by JP1/IT Desktop Management 2.

If a target program starts during the approved time and then the system time of the device is changed, the program might not be blocked even outside the approved time.

If a program is started during an approved time for which it is set, and the computer goes into a sleep or hibernation state, the program will not be restricted after the approved time has passed. The program will be restricted a while after the computer wakes from the sleep or hibernation state.

If version information for the executable file of the target program is corrupted or contradicted, the program might not be blocked even if the Original File Name setting in Windows Explorer matches the File Name setting for the program.

If startup of a program is repeatedly restricted during a short period of time, OS might display the message below. In this case, the user must terminate the program as instructed by the message, and then restart the OS.

The application failed to initialize properly (0xc0000142). Click on OK to terminate the application.

The startup of other programs that share the specified process might be restricted.

(6) Notes on restricting printing

The table below shows the printers for which printing can be restricted.

Printer type

Printing restriction

Local printer

Y

Network shared printer

Y

Internet printer

N

Virtual printer

Y

Legend:

Y:Printing can be restricted for this type of printer.

N:Printing cannot be restricted for this type of printer.

In the properties for each printer, Print and Manage Documents must be allowed for all logged on users.

When printing is restricted by Hibun, printing cannot be restricted by JP1/IT Desktop Management 2.

If printing is performed immediately after a printer is added, the printing might not be restricted.

If printing is performed immediately after you log on to the OS, the printing might not be restricted.

If a print job is finished before the print operations are notified to the agent, the printing cannot be restricted.

Depending on the printer, multiple printing restriction logs are collected at a single printing.

For the network shared printer, the following notes are added.

The table below shows the supported combination of the agent and the print server.

Agent

Print server

Printing restriction

Windows 7 or later

Windows XP/2003

N

Windows 7 or later

Windows Vista or later

Y

Any

Others

N

Legend:

Y:Printing can be restricted for this type of printer.

N:Printing cannot be restricted for this type of printer.

RPC communication must be possible between the print server and the agent PC. If RPC communication is not possible, the problem might be caused by one of the following:

The print server is a server based on the Internet Printing Protocol (IPP).

A firewall, proxy or NAT is present between the print server and the agent PC.

The agent PC's Windows firewall is enabled and File and Printer Sharing is not set to Exceptions.

The agent PC's File and Printer Sharing for Microsoft Networks must be enabled.

The print server must be able to resolve the name of the agent PC.

If the agent PC is Windows 7 or later, the agent PC and the print server must be joined in the same domain, or the credential of the print server must be registered on the Credential Manager of the agent PC. The agent PC needs to be rebooted after the credential is registered.

If IPv6 is enabled and rendering of the print job does not work on the client computer, the printing might not be restricted. To operate rendering of print jobs on the client computer, the following settings are required:

Render print jobs on client computers is enabled.

Enable advanced printing features is enabled.

With the Citrix XenApp and Microsoft RDS server, printing restriction can only be canceled by a console session. This means that you cannot cancel printing restriction by entering your password even when the Password Protected option is enabled.

(7) Notes on restricting the use of devices

JP1/IT Desktop Management 2 controls devices according to Windows rules (it cannot control devices that do not comply with Windows rules). We recommend that you check whether the target device can be controlled in advance. For specifications of a device, contact the manufacturer.

A device might not be identified depending on the OS running on the computer the device is connected to. Therefore, we recommend that you check in advance whether a device can be properly controlled by the OS being used.

How Windows identifies devices cannot be judged only by the device configuration and the product name. Check the properties in the Windows Device Manager.

Use of a device might not be restricted in the following case, despite the specified security policy:

When the device is connected to a computer before the JP1/IT Desktop Management 2 process starts (for example, immediately after the computer has started).

The device restriction feature cannot be used with other products that restrict the use of devices, for example, Windows group policy or Active Directory policy. If you use the device restriction feature with other device-restricting products, settings in each of the products might not work properly.

The computer must be restarted in the following cases:

When you want to restrict the use of a device that was connected to the computer before the security policy was applied, and the device is not a USB device.

When you want to restrict the use of a working device, and the device is not a USB device.

If you want to allow the use of a device whose use was restricted by the previous security policy but the restriction was removed by the updated security policy.

If you want to restrict the use of a device whose use was not restricted by the previous security policy but the restriction was added by the updated security policy.

If you change the security policy (to start restricting the use of a device) while file operation logs are collected, file operation logs collected just before the policy change might not be acquired.

An error might appear in the following situations:

When a device with Autoplay enabled is restricted.

When a restricted device is accessed by a tool.

If you connect a deterrence-target device to a computer for the first time.

If a device is restricted during a file operation.

If a setting on a device performed in other products violates the security policy, change the setting according to the security policy.

You cannot acquire system information or hardware information from deterrence-target devices.

If you connect a deterrence-target device to a computer for the first time, the device driver might not be able to be installed. You cannot use the device if the device driver cannot be installed.

If the device has been connected to the computer before, installation of the device driver might be performed if the device is connected to a different port, or connected by a different user. If the device was connected to the computer before the device was restricted, the restriction of the device is activated after the computer is restarted.

If a deterrence-target device (whose restriction will be activated after the computer is restarted) is connected to the computer, and you connect another device, a restriction dialog box for the deterrence-target device might reappear, or a warning message might appear.

If a deterrence-target device is identified by the OS as a different device, the device cannot be restricted. However, if the device was identified by the OS as another deterrence-target device, the device is restricted as the device identified by the OS.

If you apply a security policy restricting one or more devices to a computer running Windows Server 2019, Windows Server 2016, Windows 10, Windows 8.1, Windows 8, Windows Server 2012, Windows 7, Windows Server 2008, or Windows Vista, an error-level event might be recorded in the event logs.

If you access a deterrence-target device by a tool, an event might be output in the event logs, or an error dialog box might appear.

If you re-connect a non-USB device that has already been connected to the computer and then put into restricted status, a restriction message is not displayed, and you cannot collect connection, disconnection, or restriction logs, and suppression events.

With the Citrix XenApp and Microsoft RDS server, the type of drive that exists on the source device is displayed as Other by the session at the connection destination. You cannot restrict the use of devices for such drives.

To use the Suppression of Device Usage feature of Other Access Restrictions, the service "Portable Device Enumerator Service" must be running on an agent computer. If this service is not running, the operations might become unstable, for example, the use of a device is not suppressed or it continues to be suppressed.

This symptom might occur when all of the following conditions are met:

Portable Device Enumerator Service is not running.

In a security policy Other Access Restrictions - Suppression of Device Usage - List of devices for which the write operation is suppressed tab, any of the following settings are enabled and the security policy is (or was) applied to an agent computer:

Removable Disk - Restrict reading/writing

CD/DVD Drive - Restrict writing

FD Drive - Restrict reading/writing

To work around this symptom, check the Startup Type of the Portable Device Enumerator Service. If the setting is Disabled, set it to Manual or Automatic, and restart the agent computer.

When security policy with device connection suppression disabled is applied, disabled device# that exists might become enabled.

#: Device described in this note include all of those which could be restricted, such as USB device, Bluetooth device.

When connecting a JP1/IT Desktop Management 2 - Manager version 11-00 to an Agent version 10-10, you cannot use restricting the use of devices function on the Agent version 10-10.

Notes on restricting the use of USB devices

When a USB-connected CD/DVD drive is restricted, the tray on the restricted CD/DVD drive might open.

A USB device that was connected before the restriction-setting security policy was applied is not restricted. In this case, removing the device and then connecting it again activates the restriction.

A scanner might be identified as an imaging device if it is a USB-connected device.

If a device is a USB-connected device, it cannot be restricted if it is not identified as a USB device, Bluetooth device, or an imaging device.

If you connect a deterrence-target USB device to a computer on which AutoPlay is enabled, the AutoPlay might fail, and an error message will be output.

If AutoPlay is enabled, you cannot restrict use of a USB-connected hard disk drive or FD drive. To restrict the use of these devices, disable the AutoPlay feature.

If AutoPlay is enabled in Windows Server 2019, Windows Server 2016, Windows 10, Windows 8.1, Windows 8, Windows Server 2012, Windows 7, Windows Server 2008, or Windows Vista, use of a USB-connected hard disk drive or FD drive might not be restricted.

When Restrict the use or Allow registered USB device usage is enabled for USB devices in a security policy, auto play of removable drives and fixed drives is disabled. Even if Restrict the use or Allow registered USB device usage is disabled for USB devices or the agent is uninstalled when auto play is disabled, auto play remains disabled.

When both the following conditions are met, while copying files to or from a USB-connected hard disk drive or FD drive, use of USB devices cannot be restricted until the file copy operation finishes.

The OS of the computer is Windows Server 2019, Windows Server 2016, Windows 10, Windows 8.1, Windows 8, Windows Server 2012, Windows 7, Windows Server 2008, or Windows Vista.

You applied a security policy that restricts use of USB devices while a file is being copied.

If the computer is running Windows Server 2019, Windows Server 2016, Windows 10, Windows 8.1, Windows 8 or Windows Server 2012, any USB devices that are allocated to a memory pool are not restricted.

If you reconnect a device that was once connected to a computer and restricted by the computer, restriction message display, logs for connection, disconnection, or restriction, or restriction event might not be acquired.

The OS assigns different enumerators and device instance IDs to the same individual device, depending on if the device is normally recognized or UASP-recognized. Therefore, to allow connection for both recognitions, asset registration must be performed for both recognitions.

To restrict the use of USB devices in Citrix XenApp and Microsoft RDS environments, install JP1/IT Desktop Management 2 - Agent on the computer that is the remote connection source.

Notes on restricting the use of Bluetooth devices

If you configure to restrict Bluetooth devices, use of a Bluetooth-connected mouse or keyboard will also be restricted.

If you connect a Bluetooth device to a computer, a registry of the following Bluetooth device hardware ID is created:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\

JP1/IT Desktop Management 2 regards a device as a Bluetooth device if the Class value of this registry is Bluetooth, BTW, or BTM. You can check the hardware ID from the Device Manager window of the OS.

Notes on restricting the use of Windows portable devices

A USB device, identified as a Windows portable device on a computer on which a Windows portable device is configured as a deterrence target, is restricted as a Windows portable device. (In this case, registered USB devices whose use is allowed and USB devices connected with USB Device Registration are also restricted as Windows portable devices.)

2.9.6 Managing Windows updates

If the OSs running on the computers in your organization are Windows, Windows updates must be installed as necessary to fix errors or security problems. JP1/IT Desktop Management 2 can automatically install Windows updates released from Microsoft according to the security policy.

Important

The support services contract is required to automatically acquire the latest information about Windows updates and install the updates on your computers.

Tip

If notification is not suppressed in an agent for UNIX, OS patches can be acquired from the agent for UNIX (AIX, HP-UX, Solaris) as software information. However, you cannot automatically obtain the latest OS patch information and apply the latest OS patch to computers with the UNIX agent installed.

Tip

For Mac agents, the security policy item for automatic program update evaluates whether automatic checking for App Store updates is active. However, you cannot automatically obtain program updates and apply them to Mac agents

Using JP1/IT Desktop Management 2, you can reduce the efforts of managing Windows updates by using convenient functions as follows:

Checking the release of Windows updates

Automatically distributing and installing Windows updates on computers

Installing different combinations of Windows updates for individual groups

You can manage Windows updates in the Windows Update view of the Security module. The following figure shows the concept of managing Windows updates.

After Windows updates are released from Microsoft, information about the updates is automatically acquired from the support service site. At this time, the administrator can be automatically notified by email. After the information about the updates is acquired, the update list is automatically updated.

When All updates are installed is set in a security policy, the Windows update information added to the list is applied to the security policy, and the latest status of whether the updates have been installed is judged. If updates have not been installed on some computers, the updates can be automatically distributed and installed on those computers.

By creating update groups, you can change how Windows updates are judged for each security policy. By creating a test group, you can first test whether updates will cause problems on the computers in your organization. Then, you can automatically install only the safe updates.

You can also register and distribute Windows updates manually.

For details on acquiring information from the support services, see the JP1/IT Desktop Management 2 Administration Guide.

Tip

You can use both the function of automatically distributing Windows updates using a security policy and the Windows automatic update function (Windows Update or Microsoft Update) at the same time. However, you cannot use JP1/IT Desktop Management 2 to control which function is to be used for installing Windows updates. If you want to install all the mandatory updates provided by Microsoft, we recommend that you enable Windows automatic update. If you want to install only the special updates, we recommend that you use the JP1/IT Desktop Management 2 function to distribute the updates.

Tip

Security judgment for cumulative updates and Security Monthly Quality Rollup for Windows is possible even when the latest update has been released but the update information posted on the support service site has not yet been updated. Security judgment can also be performed taking into consideration the grace period given to apply updates. However, the automatic distribution of the latest cumulative updates and Security Monthly Quality Rollup by means of a security policy is not possible. For details, see the description of judgment for cumulative updates and Security Monthly Quality Rollup for Windows in the manual JP1/IT Desktop Management 2 Administration Guide.

Tip

You can package and distribute Windows updates and a feature update to Windows 10 by using Remote Install Manager. For details, see the description of managing updates in the manual JP1/IT Desktop Management 2 Distribution Function Administration Guide.

Creating an update group

When you set Selected updates are installed in a security policy, you can use an update group to apply only the Windows updates allowed by the administrator for installation to the security policy. For details about update groups, see (9) Managing update groups.

Related Topics:

(1) Prerequisites for acquiring and distributing Windows updates

(3) Types of Windows updates for which information can be automatically acquired

(2) Notes on acquiring Windows updates

(6) Checking the status of Windows updates

(1) Prerequisites for acquiring and distributing Windows updates

The following shows the prerequisites for acquiring Windows updates from the Microsoft website based on the Windows update information acquired from the support service site, and for automatically distributing the update to computers.

Prerequisites for automatically acquiring information about Windows updates from the support service site:

The support services contract is made.

MSXML 4.0 Service Pack 2 or MSXML 6.0 is installed.

The management server can connect to the Internet.

Tip

To acquire information about Windows updates from the support service site, the settings for connecting to the support service site are required.

Tip

Even in an environment where the management server cannot connect to the Internet, if another computer can connect to the Internet, you can manually acquire and then register Windows update information from the support service site.

Prerequisites for automatically acquiring Windows updates from the Microsoft website and distributing the updates:

The management server can connect to the Internet.

The management server and the distribution-destination computer are connected.

An agent is installed on the distribution-destination computer.

Tip

To distribute Windows updates to computers, Windows update files are required. In an environment where the management server can connect to the Microsoft website via the Internet, Windows updates are automatically downloaded, and the Windows update files are registered.

Even in an environment where the management server cannot connect to the Internet, if you use another computer that can connect to the Internet to acquire Windows updates (execution files) from the Microsoft website, you can manually register the Windows update files.

(2) Notes on acquiring Windows updates

The following notes give restrictions related to acquiring Windows updates:

When you distribute acquired Windows updates to other computers, do so after making sure that the updates can be properly distributed and installed on the target computers. Depending on the computer environment, distribution or installation of updates might fail.

You cannot acquire the following Windows updates:

Windows updates provided earlier than January 1 2006 by Microsoft

Windows updates provided by Microsoft Security Advisory

Windows updates corresponding to the PC-98 series computers

The files related to the information about Windows updates are stored in JP1/IT Desktop Management 2-installation-folder\mgr\OSPATCH. Do not change or delete the files in this folder. If you change or delete the files in this folder, correct operation of JP1/IT Desktop Management 2 is not guaranteed.

If the Windows Automatic Updates option for Auto Enforce is enabled in a security policy for Windows Updates, when Windows Updates are executed to the target device has been turned OFF, the device will be turned ON automatically. Once the Windows Updates are complete, the target device will be turned OFF.

Related Topics:

(1) Prerequisites for acquiring and distributing Windows updates

(3) Types of Windows updates for which information can be automatically acquired

By connecting to the support service site, you can acquire information about Windows updates released from Microsoft, and automatically apply the information to security-judgment targets. Also, by setting automated countermeasures in a security policy, you can automatically distribute and install Windows updates to computers.

Information about Windows updates for the following programs can be automatically acquired from the support service site.

Program

Type or version

Windows

Windows Server 2022#

Windows Server 2019#

Windows Server 2016

Windows 10

Windows 8

Windows 7

Windows Server 2012

Windows Server 2008

Windows Vista

Windows Server 2003

Windows XP

Windows 2000

Internet Explorer

9.0 or later

#: Japanese version is supported.

Information about Windows updates can be acquired only for the updates that satisfy the following conditions:

The class (the type of Windows update) is Windows Update.

The security number is set (not empty).

The severity is Critical or Important.

There is information about the service pack number or version of the target OS.

(4) Automatically registering Windows Update files

The Windows updates and installation scripts that are necessary for distribution are automatically downloaded from the Microsoft website and the support service site, and then the Windows Update files are registered. By using this function, the administrator can reduce the efforts of regularly downloading Windows updates because the latest updates can always be acquired and distributed automatically.

Important

A support services contract is required to automatically download Windows updates and installation scripts.

The following figure shows the flow of automatically registering the Windows Update files.

Note that registered Windows Update files are not added to the Package List view of the Distribution (ITDM-compatible) module. Windows Update files can be distributed only by automated countermeasures for a security policy. You cannot manually create a task for distributing Windows updates. You can check the executed tasks in the Distribution (ITDM-compatible) module.

(5) Manually registering Windows Update files

By downloading the Windows updates necessary for distribution from the Microsoft website, the administrator can add Windows updates to the management server at any time and register the Windows Update files. The added updates are automatically installed on users' computers. This function is convenient when you want to immediately distribute Windows updates that are important for security without waiting for automated countermeasures of JP1/IT Desktop Management 2.

When manually registering Windows Update files, the administrator must perform all tasks for downloading Windows updates and registering the Windows Update files.

The following figure shows the work flow for manually registering Windows Update files.

Tip

In an environment where the Administrator's computer cannot connect to the Internet (when the update list is updated offline), use another computer that can connect to the Internet to register the Windows Update files.

In this case, on a computer that can connect to the Internet, display the operation window. On the Windows Update Information tab of the Windows Update view, download the Windows updates from Execution File Download URL. After that, from the Action menu, select Register Windows Update File, and then specify the downloaded updates. Thus, you can register the Windows Update files.

Note that the created Windows Update files are not added to the Package List view of the Distribution (ITDM-compatible) module. The Windows Update files can be distributed only by automated countermeasures for a security policy. You cannot manually create a task for distributing Windows updates. You can check the executed tasks in the Distribution (ITDM-compatible) module.

Tip

Security updates that were manually registered cannot be judged if the expected status of a security policy is All updates are installed. To judge the security status, manually register security updates to Update Group and then configure the following settings in Windows Update of the security policy. Judgment will be performed for Windows updates that were manually registered and, if violations are found, automated countermeasures will be executed.

Configuration Item: Check the Install Updates.

Expected Status: Select a Windows update group in Mandatory Update Group: under the Selected updates are installed.

Automated countermeasure: Select the check box and then select Distribute Windows Update.

(6) Checking the status of Windows updates

You can check whether Windows updates have been installed in the following ways.

Checking for Windows updates that have not been installed on some computers:

In the Windows Update Status report (under Security Detail Reports), you can check Windows updates. The Windows updates are listed in the order of the number of computers on which the update has not been installed.

Checking the violation level for each security policy:

On the Windows Update tab of the Security Policy List view (under the Security module), you can check violation levels. If there is a problem related to violation level, there might be computers on which one or more Windows updates have not been installed.

Checking the status of whether Windows updates have been installed for each device:

On the Windows Update tab of the Computer Security Status view (under the Security module), you can check the status of whether Windows updates have been installed on each device. If one or more Windows updates have not been installed on a computer, those updates are displayed.

Checking for computers on which Windows updates have not been installed:

On the Not Applied Computers tab of the Update List view (under the Security module), you can check for computers on which Windows updates have not been installed.

(7) Updating the update list

JP1/IT Desktop Management 2 can automatically update the list of registered old Windows updates by regularly accessing the support service site. This is done based on support contract information or a schedule set by the administrator. This enables the administrator to check whether the latest Windows updates have been installed on all computers, or to check for Windows updates that have not been installed, without the need of performing special operations.

The update list is automatically updated once a day. The time it is updated is the same as the time the setup processing (which is performed immediate after JP1/IT Desktop Management 2 is installed) was completed. The minutes are rounded up to the nearest later hour. For example, if the setup for JP1/IT Desktop Management 2 finishes at 10:30, the update list is updated at 11:00 every day.

Important

A support services contract and an environment where the management server can connect to the Internet are required.

Important

The update list is automatically updated about 10 business days after the latest Windows updates are released from Microsoft. This is because it takes about 10 days from the release of Windows updates until the update of the information on the support service site. If you want to immediately add the information about the released Windows updates, the administrator must acquire the Windows updates and the information about Windows updates from the Microsoft website, and then manually add them to the update list.

Related Topics:

(3) Types of Windows updates for which information can be automatically acquired

(5) Manually registering Windows Update files

(8) Mail notification of updating the update list

When the update list is automatically updated, the updated contents can be reported to the administrator by email. In the email, information about the added Windows updates is described. The administrator can understand the details about the added Windows updates just by reading the email.

Important

The mail server settings and the support service settings are required in advance.

The following is an example email report.

(9) Managing update groups

When you want to judge only whether specific Windows updates have been installed, create an update group that groups the target Windows updates. Since an update group is specified in the security policy, only the Windows updates registered in the group will be judged.

By using an update group, you can centrally manage which Windows updates will be judged by different security policies.

The following figure shows the concept of managing Windows updates to be judged by using an update group.

For example, even when different security policies are used for the sales department and the development department, you can configure the settings so that the same Windows updates are installed. By specifying an update group common to the sales department and the development department for the judgment-target Windows updates, you can centrally manage the updates to be installed while using different policies for different departments.

Also, you can use an update group when you want to distribute Windows updates after making sure that installing the updates causes no problems in your organization. Even if you acquire information about Windows updates from the support service, the information is not automatically applied to the update group. By additionally registering Windows updates in the update group, you can add the judgment-target updates without the need of editing a security policy. Therefore, by registering the Windows updates that have already been tested in the update group, only the updates allowed by the administrator can be installed and managed.

(10) Judging the results of distributing Windows updates

Whether a Windows update is successfully distributed is judged by the return value when the update is installed. The following shows the values returned when a Windows update is installed.

Return value

Description

0

Installation successfully finished.

1

Installation failed.

2

The environment is invalid (such as memory shortage or invalid file).

3

An internal error occurred.

4

The installation status of Windows Script Host (WSH) is invalid.

5

An internal error occurred.

(11) Importing and exporting the updated program list

A list of updated programs registered with a management server can be exported to a CSV file. The exported CSV file containing the updated program list is called a patch information CSV file. The exported patch information CSV file can be imported to the source management server or other management servers.

The following table lists commands to import and export the updated program list:

Command

Description

ioutils exportupdatelist

Exports a patch information CSV file containing a list of updated programs that were manually registered with a management server.

ioutils importupdatelist

Imports a patch information CSV file containing the updated program list that was exported from a management server.

When multiple management servers exist, you can use these commands to ensure that the same updated programs are registered with every management server.

2.9.7 Malware-infected device control function through Microsoft Intune linkage

If you are using Microsoft Intune as MDM System and you are using Agent to deploy Managed devices and manage both Microsoft Intune and JP1/IT Desktop Management 2 - Manager, you can automatically blocked malware-infected devices detected by Microsoft Intune from Network.

If the device is in the malware state shown below in Microsoft Intune, the device permission state in JP1/IT Desktop Management 2 - Manager will be "Force blocked" and the network connection will be blocked.

Active

Removal failure

Requires manual steps

Full scan required

Requires Restart

Allowed

The computer user deletes the malware on the device to which network connection was blocked and execute for another virus scan. After scanning for viruses and verifying that the device is safe, the administrator manually recovers network connection.

Important

Even if the device is managed together, the management server, the relay system, and the computer with Network Monitor enabled cannot block the network connection.

Important

The malware-infected device control function can control up to 30,000 devices.

Tip

If Network Connect of many devices is turned blocked for reasons such as malware error detection in Microsoft Intune, you can also download the network control list just before it was shut down and restore network connectivity all at once.

For details on how to operate malware-infected device control, refer to the explanation of the procedure for enabling the setting of malware-infected device control with Microsoft Intune in the manual JP1/IT Desktop Management 2 Administration Guide.

2.10 Managing operation logs

You can collect operation logs from a target computer if you set collection of operation logs in a security policy and assign the security policy to the target computer.

To collect operation logs, an agent must be installed on the target computer. Also, to save the collected operation logs on the management server, Setup must be configured on the management server so that operation logs can be collected.

Important

The management of the operation logs is not available for API-controlled devices.

You can change the types of operation logs to be collected in the security policy settings. You can also change the setting of whether to detect suspicious operations in the security policy settings.

The following table shows the categories of suspicious operations and how to confirm them.

Category

Suspicious operations to be reported in the security policy

Confirmation methods

Security module > Operation Logs > Operation Log List view

Events module > Events > Event List

Suspicious Operations panel

Suspicious file operations

Send/Receive E-mail with Attachments

Suspicious column

An icon is displayed.

Operation Type (Detail) column

Send Mail (Attachment File) is displayed.

In the Type column, Suspicious is displayed.

Send E-mail with Attachments is displayed.

Use Web/FTP Server

Suspicious column

An icon is displayed.

Operation Type (Detail) column

Web Access (Upload) or Web Access (Download) is displayed.

In the Type column, Suspicious is displayed.

Use Web/FTP Server is displayed.

Copy/Move the File to External Device

Suspicious column

An icon is displayed.

Operation Type (Detail) column

Copy file or Move file is displayed.

In the Type column, Suspicious is displayed.

Copy/Move the File to External Device is displayed.

Suspicious print operation

Large Number of Printing Jobs

--

In the Type column, Suspicious is displayed.

--

Legend: --: Not displayed.

If conditions for suspicious file movement operations are set in the security policy, you can track the history of such operations using the operation logs.

For details about suspicious file movements, see 2.10.3 Investigating suspicious movements of files from systems using operation logs. For details about suspicious print operation, see 2.10.5 Collecting logs for suspicious print operations.

Tip

Collecting all types of operation logs might consume large amount of disk capacity. You can reduce consumption of disk capacity by collecting only the operation logs directly related to information leakage, or by specifying the target operations.

Important

An agent for UNIX or Mac is excluded from operation log collection.

Important

When the number of managed computers is more than 30,000 and you want to collect operation logs, you must use a multi-server configuration so that management relay servers can collect the information. Do not collect the information by using the primary management server. In addition, configure the settings so that the operation logs are not sent from a management relay server to the primary management server.

Important

There might be a discrepancy between the number of suspicious operations (each day) displayed in the Suspicious Operations panel and the number of suspicious operations displayed in the operation log list (which is accessed from the anchor). This problem occurs in any of the following cases:

There is a time lag in sending suspicious operations notifications to the management server from the agent.

Time lags can occur due to an agent-installed computer shutting down or due to network connection problems.

The system clocks on the agent-installed computer and the management server don't coincide.

Operation logs might be registered as the operations that happened before or after the date of notification to the management server.

Operation logs are enabled, but the operation logs for that day are not restored.

In this case, cross-check the suspicious operations of that day by viewing the Events module, and check the operation logs of each corresponding computer (the operation source) in the operation log list or check the operation logs before and after that day in the operation log list.

Important

If an agent's OS is Windows 7, collection of operation logs cannot be performed on Windows XP Mode.

Important

If 16-bit software is used, operation logs of Program Execution, Program Termination, and Window Operation cannot be collected.

2.10.1 Types of operation logs that can be collected

The table below shows the types of operation logs that can be collected in JP1/IT Desktop Management 2.

Tip

When you configure the settings in a security policy so that suspicious operations can be detected, whether an operation is a suspicious operation is judged based on operation logs. Only a part of operation log types related to suspicious operations are used for such a judgment. If you select Only operations that divulge information (recommended) in a policy for operation logs, you can collect only the operation logs related to suspicious operations.

Types of operation logs

Operation Type

Operation Type (Detail)

Description

Behavior when Only operations that divulge information (recommended) is selected in a policy for operation logs

Power ON/Shut Down/Log On/Log Off

Power ON

A user started the computer.

Y

Shut Down

A user shut down the computer.

Y

Log On

A user logged on to Windows.

Y

Log Off

A user logged off from Windows.

Y

Program Execution/Termination

Program Execution

A user started a program.

N

Program Termination

A user stopped a program.

N

File Operation/Print Operation

Copy file#1

A user copied a file.

C

Move file#1

A user moved a file.

C

Rename file#1

A user renamed a file.

C

Create file#1

A user created a file.

C

Delete file#1

A user deleted a file.

C

Web Access (Upload)#2

A user uploaded a file via a web browser.

C

Web Access (Download)#2

A user downloaded a file via a web browser.

C

FTP (Send File)#2

A user sent a file to an FTP server via a web browser.

C

FTP (Receive File)#2

A user received a file from an FTP server via a web browser.

C

Send Mail (Attachment File)#3

A user sent an email with attachment.

C

Receive Mail (Attachment File)#3

A user received an email with attachment.

C

Save Attached File#3

A user saved a file that was attached to a received email.

C

Print#4

A user submitted a print job.

N

Folder Operation#1

Copy folder

A user copied a folder.

N

Move folder

A user moved a folder.

N

Rename folder

A user renamed a folder.

N

Create folder

A user created a folder.

N

Delete folder

A user deleted a folder.

N

Device operation

Device connection

A user connected a device to the computer.

Y

Device disconnection

A user disconnected a device from the computer.

Y

Permitting device connection

A device connection was permitted when usable devices are set for prohibited operations.

Y

Web Access

Web Access#5

A user accessed a web service via a web browser.

N

Window Operation

Change active window

A user changed the active window.

N

Console Operation

Commands executed in Command Prompt

The command was executed at the command prompt.

N

Commands executed in PowerShell

The command was executed on PowerShell.

N

Executed batch files

The batch file was executed.

N

Executed PowerShell script files

PowerShell script file was executed.

N

Deterrence Log

Block Program Activation

Startup of a program was blocked (when prohibited software programs are set).

Y

Block Printing#4

Printing was blocked (when prohibited operations are set).

Y

Block Device Connections

Use of a device was blocked (when prohibited operations are set).

Y

Legend: Y: Collected. C: Collected when the conditions for determining that the operation is a suspicious file movement are satisfied. N: Not collected.

For details about the conditions for determining that an operation is a suspicious file movement, see 2.10.4 Conditions for determining whether a file is to be monitored for suspicious file movements.

#1

Operation logs can be collected only when the operations are performed using Windows Explorer.

Important

Operation logs cannot be collected when the operations are performed from the command prompt or in application programs.

#2

Operation logs can be collected only when Internet Explorer 9, 10, or 11 and Microsoft Edge (IE mode) is used.

Important

If you launch an application from Internet Explorer and Microsoft Edge (IE mode) and then perform an operation in the application that was launched, you will not be able to collect operation logs.

#3

Operation logs can be collected when one of the following email clients is used:

Microsoft Outlook 2002, 2003, 2007, 2010, 2013, 2016, and 2019

Windows Live Mail 2009, 2011, and 2012

#4

Operation logs can be collected when the following types of printers are used:

Local printers

Network shared printers

Virtual printers

Important

Operation logs cannot be collected for printers connected via the Internet. Also, if the File port is used on a local printer, operation logs for Block Printing cannot be collected. When a LAN Manager port is used, operation logs for Print and Block Printing cannot be collected.

#5

Operation logs can be collected only when using Internet Explorer 9, 10, or 11, Microsoft Edge, or Google Chrome.

Tip

For details about the items of the HIBUN operation logs when these logs are imported, see 2.10.8 Importing HIBUN logs into the management server.

Related Topics:

(1) Collecting logs for suspicious movements of files from systems

2.10.7 Prerequisites and notes on collecting operation logs

(1) Information collected for each type of operation log

The following shows information collected for each type of operation log. For details about the information collected for individual information items, see Details about the information items to be collected. The following legend is used for the tables below:

Legend: Y: Collected. M: Might not be collected depending on the device or disk status. N: Not collected.

Power ON/Shut Down/Log On/Log Off

The following table shows the information items to be collected when Power ON/Shut Down/Log On/Log Off is the target operation type.

Operation Details

Information to be collected

Source

Operation Date/Time#

User Name

Power ON

Y

Y

N

Shut Down

Y

Y

N

Log On

Y

Y

Y

Log Off

Y

Y

Y

#: Operation Date/Time information includes Operation Date/Time (Browser), Operation Date/Time (Source), and Time Zone.

Program Execution/Termination

The table below shows the information items to be collected when Program Execution/Termination is the target operation type. Note that Source, Operation Date/Time (Browser), Operation Date/Time (Source), Time Zone, and User Name are collected for every operation.

Operation Details

Information to be collected

User Name

File Version#

File Name

Command Line

Program Execution

Y

Y

Y

Y

Program Termination

Y

Y

Y

N

#: This item is collected only when the program (execution file) has a version number.

File Operation/Print Operation

The table below shows the information items to be collected when File Operation/Print Operation is the target operation type. Note that Source, Operation Date/Time (Browser), Operation Date/Time (Browser), Time Zone, and User Name are collected for every operation.

Operation Details

Information to be collected

File Created Date/Time

File Last Modified Date/Time

File size

Original File Drive Type / Original File Created Date/Time

Original File Name / Drive type

Destination File Name / Drive Type

Copy file

Y

Y

Y

Y

Y

Y

Move file

Y

Y

Y

Y

Y

Y

Rename file

Y

Y

Y

Y

Y

Y

Create file

Y

Y

Y

Y

Y

N

Delete file

Y #1

Y #1

Y #1

Y

Y

N

Web Access (Upload)

Y

Y

Y

Y

Y

Y

Web Access (Download)

Y

Y

Y

Y

Y

Y

FTP (Send File)

Y

Y

Y

Y

Y

Y

FTP (Receive File)

Y

Y

Y

Y

Y

Y

Send Mail (Attachment File)

Y

Y

Y

Y

Y

Y

Receive Mail (Attachment File)

N

N

N

Y

Y

Y

Save Attached File

Y

Y

Y

Y

Y

Y

Print#2

N

N

N

N

N

N

#1: It might not be possible to collect File Created Date/Time, File Last Modified Date/Time, or File Size information depending on how the file is deleted.

#2: Only Printer Name, Printed Document Name, and Printed Page Count can be collected.

Folder Operation

The table below shows the information items to be collected when Folder Operation is the target operation type. Note that Source, Operation Date/Time (Browser), Operation Date/Time (Source), Time Zone, and User Name are collected for every operation.

Operation Details

Information to be collected

Source File Name

Source File Drive Type

Destination File Name

Destination File Drive Type

Copy folder

Y

Y

Y

Y

Move folder

Y

Y

Y

Y

Rename folder

Y

Y

Y

Y

Create folder

Y

Y

N

N

Delete folder

Y

Y

N

N

Device connection or disconnection

The table below shows the information items to be collected when Device connection or disconnection is the target operation type. Some information might not be collected depending on the device. Note that Source, Operation Date/Time (Browser), Operation Date/Time (Source), Time Zone, and User Name are collected for every operation.

Operation Details

Information to be collected

Drive Type#1

Drive Name#2

Device Name

Serial #

Device Instance ID

Device Type#3

Device category

Device connection

Y

Y

Y

Y

Y

Y

Y

Device disconnection

M

M

M

M

M

M

M

Permitting device connection

Y

Y

Y

Y

Y

Y

Y

#1: Others is output in the case of a built-in FD drive, Bluetooth device, imaging device, or Windows portable device.

#2: Information cannot be collected in the case of a built-in FD drive, Bluetooth device, imaging device, or Windows portable device.

#3: Information can be collected only in the case of a USB device.

Web Access

The table below shows the information items to be collected when Web Access is the target operation type. Note that Source, Operation Date/Time (Browser), Operation Date/Time (Source), Time Zone, and User Name are collected for every operation.

Operation Details

Information to be collected

Web Page Title

URL

Web Access

Y

Y

Window Operation

The table below shows the information items to be collected when Window Operation is the target operation type. Note that Source, Operation Date/Time (Browser), Operation Date/Time (Source), Time Zone, and User Name are collected for every operation.

Operation Details

Information to be collected

Execute Account

File Version#

File Name

Window Title

Window Operation

Y

Y

Y

Y

#: This item is collected only when the execution file has a version number.

Console Operation

Console operation includes Commands executed in Command Prompt, Commands executed in PowerShell, Executed batch files, and Executed PowerShell script files. The tables below show information items to be collected when those are the target operations. Note that Source, Operation Date/Time (Browser), Operation Date/Time (Source), Time Zone, and User Name are collected for every operation.

Operation Details

Information to be collected

Execute Account

Command Line

Execution Results

Execution Script

Content of Execution Script

Commands executed in Command Prompt

Y

Y

Y

N

N

Commands executed in PowerShell

Y

Y

Y

N

N

Executed batch files

Y

N

N

Y

Y

Executed PowerShell script files

Y

N

N

Y

Y

Deterrence Log

Deterrence Log includes three types of operations: Block Program Activation, Block Printing, and Block Device Connections. The tables below show information items to be collected when those are the target operations. Note that Source, Operation Date/Time (Browser), Operation Date/Time (Source), Time Zone, and User Name are collected for every operation.

Block Program Activation

Operation Details

Information to be collected

Software Name

Software Version

User Name

File Version#

File Name

Block Program Activation

Y

Y

Y

Y

Y

#: This item is collected only when the execution file has a version number.

Block Printing

Operation Details

Information to be collected

Printer Name

Printed Document Name

Printed Page Count

Block Printing

Y

Y

N

Block Device Connections

Operation Details

Information to be collected

Drive Type#1

Drive Name#2

Device Name

Serial #

Device Instance ID

Device Type#3

Device category

Block Device Connections

Y

Y

Y

Y

Y

Y

Y

#1: Others is output in the case of a built-in FD drive, Bluetooth device, imaging device, or Windows portable device.

#2: Information cannot be collected in the case of a built-in FD drive, Bluetooth device, imaging device, or Windows portable device.

#3: Information can be collected only in the case of a USB device.

Details about the information items to be collected

The following table shows the details about the information items to be collected for operation logs.

Item

Description

Source

The fully qualified domain name (FQDN) of the computer on which operation logs were collected.

Display example: dmp530

Host ID

A unique ID to identify a computer in a system.

Operation Date/Time (Browser)

Date and time the operation was performed. The displayed value is converted to the local time of the computer on which operation logs are displayed.

Display example: 2011/10/01 22:00:01

Operation Date/Time (Source)

Date and time the operation was performed. The displayed value is converted to the local time of the computer on which operation logs were collected.

Display example: 2011/10/02 17:11:51

Operation Date/Time (UTC)

Date and time the operation was performed. The displayed value is the UTC time on which operation logs were collected.

Display example: 2011/10/02 08:11:51

Time Zone

Time zone of the computer on which the operation was performed. The difference with UTC is displayed. In the Log Details dialog box, this value is displayed in the Operation Date/Time (Source) item.

Display example: GMT+09:00

User Name

Account name of the user who was logged on to the source computer.

Display example: Hostname\user1

Execute Account

Account name of the user who executed the source program.

Display example: Hostname\user1

File Version

File version displayed on the Version tab of the Properties dialog box for the operation-target file.

Display example: 1.0.0.111

File Name

Name of the operation-target file including the file path.

Display example: C:\TEMP\game.exe

File Created Date/Time

Date and time the operation-target file was created.

Display example: 2011/10/01 22:00:01

File Last Modified Date/Time

Date and time the operation-target file was updated.

Display example: 2011/10/02 22:00:01

File Size

Size of the operation-target file.

Display example: 10.2KB

Original File Drive Type

When a suspicious file operation is detected, this item indicates where the original file was located.

Other

Local Disk

Network Drive

Removable Disk

CD-ROM

RAM Disk

Web

FTP

E-mail

Display example: RAM Disk

Original File Created Date/Time

Date and time the operation-target file was first detected after collection of operation logs started.

Display example: 2011/10/01 22:00:01.159

Source File Name

Full path to the source file (or folder), or URL of the website to which the file was uploaded or from which the file was received via FTP. For a network drive, the name is indicated in UNC format. If an email with attachment was received, this item indicates the email header. If an attached file was saved, this item indicates the attached file name without a path name.

Display example: \\dmp110\share

Source File Drive Type

Type of drive in which the source file was stored.

Other

Local Disk

Network Drive

Removable Disk

CD-ROM

RAM Disk

Web

FTP

E-mail

Display example: Local Disk

Destination File Name

Full path to the destination file (or folder), or URL of a website to which the file was uploaded or sent via FTP. For a network drive, the name is indicated in UNC format. If an email with attachment was sent, this item indicates the email header. If an email with attachment was received, this item indicates the attached file name without a path name.

Display example: c:\work\program

Destination File Drive Type

Type of the drive in which the destination file was stored.

Other

Local Disk

Network Drive

Removable Disk

CD-ROM

RAM Disk

Web

FTP

E-mail

Display example: Network Drive

Printer Name

Name of the printer used for printing.

Display example: printserver01

Printed Document Name

Name of the printed document.

Display example: FunctionalSpecification.doc

Printed Page Count

Total number of printed pages. This item is not displayed if it cannot be collected.

Display example: 5

Drive Type

Type of the drive connected to the computer. Information is displayed as a number.

Other

Local Disk

Network Drive

Removable Disk

CD-ROM

RAM Disk

Web

FTP

E-mail

Display example: Network Drive

Drive Name

Name of the drive connected to the computer. Indicated as A: to Z:.

Display example: G:

Device Name

Name of the connected device.

Display example: Hitachi USB xxxxx

Serial #

Serial number of the connected device.

Display example: 1234567890ABCD

Device Type

Type of connected device.

Display example: Disk Drive

Device category

Type to distinguish a device.

Display example: Built-in SD card

Device Instance ID

Device instance ID of the connected device.

Display example: USB\VID_xxxx&PID_xxxx\1234567890ABCD

Web Page Title

Title of the web page the user accessed.

Display example: Hitachi

URL

URL of the web page the user accessed.

Display example: http://www.hitachi.co.jp/

Window Title

Caption of the active window.

Display example: game

Software Name

Name of the software program for which startup was blocked. Displays the name of the blocked software program set in the security policy.

Display example: game

Software Version

Version of the software program for which startup was blocked. Displays the version of the blocked software program set in the security policy.

Display example: 5.1.2600.5512

Execution Account

The name of the account that execute the command prompt, PowerShell, or script files.

Command Line

On Starting/adding a program, the command line of the process is output.

For console actions, the command line that was executed at the command prompt or PowerShell is output.

Execution Results

This is the content output to the command prompt or PowerShell by the command

Execution Script

The absolute path of the executed script file. The sequential number of the script file to be split is added to the end in the format of "(Sequential number/Parameter)".

Content of Execution Script

The contents of the script file.

2.10.2 Managing operation logs on the management server

Operation logs collected on a computer managed online are stored in an operation log backup folder via the management server. By restoring the operation logs to a database on the management server, you can view the operation logs from the Operation Logs view of the Security module.

Storing the operation logs on the management server

The operation logs collected on the management server are stored in an operation log backup folder. If automatic restoration of operation logs is enabled, the operation logs are automatically restored to the operation log database. To view the operation logs stored in the backup folder, restore them from the backup folder to the database.

Operation logs collected on the management server are saved in the database for about one month. The operation logs that are older than about one-month-old are automatically deleted from the database.

Note that if automatic backup of operation logs has been configured in Setup, operation logs are automatically backed up every day. You can view the backup operation logs by temporarily restoring them from the backup folder to the database. After deleting the restored operation logs, you can restore the operation logs for a different time period to the database. This enables you to view past operation logs.

When you restore the operation logs, if the data already restored includes a part of the specified restoration range, all the operation logs are overwritten.

Important

If operation logs have not been collected on the management server, the Operation Logs view is not displayed.

Important

If you enable automatic restoration without setting the operation log backup folder, the operation logs are automatically restored in the operation log database, but are not stored in the operation log backup folder. In this case, failure in the operation log database might not be recovered. Therefore, we recommend that you specify the backup folder.

Important

The operation log contains a large amount of data, so the disk capacity might become insufficient. If the disk capacity is insufficient, the following problems might occur. To prevent these problems, perform maintenance regularly.

The database becomes blocked.

An attempt to receive inventory or operation logs from agents fails.

An attempt to update device change logs fails.

An attempt to register, update, or search for operation logs fails.

An attempt to back up, restore, or reorganize the database fails.

Tip

We recommend that you use high-capacity drives, such as RAID or NAS, for the backup folder because large amounts of data might be stored in the backup folder over a long period of time.

Important

Save only operation log files in the operation log backup folder.

Important

The shutdown operation logs for shared VDI-based virtual computers are acquired after logoff. Under the following circumstances, the initialization of virtual computers causes the operation logs to be deleted, and you will not be able to acquire the operation logs:

When a virtual computer employing the floating technology provided by VMware Horizon View, the random technology provided by the MCS (Machine Creation Services) of Citrix Virtual Desktops, or the PVS (Provisioning Services) technology provided by Citrix Virtual Desktops is shut down

When a virtual computer employing the dedicated technology provided by VMware Horizon View or the static technology provided by the MCS of Citrix Virtual Desktops is shut down and the master is updated

Storing the operation logs on a user's computer

You can store operation logs for a certain amount of time on a user's computer in case the computer fails to connect to the management server. You can specify a time period to keep the operation logs in the security policy. Operation logs that are not sent to the management server are temporarily saved on the computer, and resent to the management server at the time specified by the security policy.

The operation logs can easily become large amounts of data. Therefore, set the time period for which the operation logs are kept after calculating the required disk capacity, based on the following formula:

260 x Time period (days) = Required disk capacity (KB)

If you are using the operation logging function in a Citrix XenApp and Microsoft RDS environment, you have to further multiply this figure by the number of logged-in users.

Note: The required disk capacity varies depending on the acquired operation log items and user operations.

Important

If processing is interrupted while the computer is communicating with the management server, some operation logs might be duplicated because the same data is notified at the next connection.

Related Topics:

2.10.1 Types of operation logs that can be collected

2.18.11 Managing operation logs in a multi-server configuration

(1) Backing up and restoring operation logs on the management server

If the management server is configured to back up operation logs, you can collect a history of user operations as operation logs, and save them in an operation log backup folder.

Operation logs are collected from agent-installed computers at an interval specified by the security policy. The collected operation logs are accumulated in a data folder, and then stored in an operation log backup folder. You can also automatically restore collected operation logs to the operation log database.

The operation logs that have been restored to the operation log database can be viewed in the Operation Logs view in the Security module. To check past operation logs, restore them to the database, and then view the past operation logs in the Operation Logs view. You can clear the data in the database for restoration if you no longer need to view the data.

Note that backing up or restoring databases using Database Manager does not back up or restore the operation log database. You must back up or restore the operation log data manually.

Important

When the management server has been configured in Setup so that operation logs are not collected, even if you enable collection of operation logs in a security policy, the operation logs collected from a computer are not saved.

Important

Operation logs collected from a computer are not saved if the operation date and time of the operation logs is before the year 2000, or after more than 7 days from the current time on the management server.

(2) Backing up operation logs on the management server

Operation logs collected from computers are accumulated in a data folder and stored in the operation log backup folder once an hour.

Data to be backed up

Backup files for operation logs grouped by date with each group stored in a date folder, and stored in the Operations log backup folder specified during the Setup.The format of the date folder is OPR_DATA2_YYYYMMDD.

Size required for backup

The following conditions are used as guides to explain how to calculate the size required for backing up operation logs.

Number of managed computers: 10,000 machines

Number of occurrences of operation logs per day: 2,000 logs/machine

Data size of an operation log: 500 bytes

Compression ratio of a ZIP file: 6.7%

Note: All the above conditions are set as guides.

Size of operation log data

Size of operation log data per machine: 2,000 (logs) x 500 (bytes) = about 1 (MB)

Size of operation log data for 10,000 machines: 1 (MB) x 10,000 (machines) = 10 (GB)

Size of operation log data for 10,000 machines for one month (20 business days): 10 (GB) x 20 (days) = about 200 (GB)

Size of backup file data

Size of backup file data per machine: 1 (MB) x 6.7% = about 67 (KB)

Size of backup file data for 10,000 machines: 67 (KB) x 10,000 (machines) = about 670 (MB)

Size of backup file data for 10,000 machines for one month (20 business days): 670 (MB) x 20 (days) = 13.4 (GB)

Thus, you can calculate the sizes of operation log data and backup file data. Secure the free space for the database and for the backup-destination drive, considering the number of managed computers and the collection period of the operation logs.

Mail notification about free space shortage

You can configure to receive a mail notification when the free space on the backup destination is insufficient. The following are the triggers for mail notification:

Backup fails

If backup fails due to a shortage of the backup-destination drive capacity, a Critical error event is displayed in the Events module. In this case, a mail notification is automatically sent if mail notification of such events has been set.

Periodic monitoring detects free space shortage

If free space on the backup-destination drive is insufficient, an error event is displayed in the Events module. In this case, a mail notification is automatically sent if mail notification of such events has been set. Note that you can change the threshold value to output the insufficient free-space event by editing the properties of the configuration file. For properties of the configuration file, see A.5 Lists of properties.

(3) Restoring operation logs to the management server

To view operation logs, you need to restore them to the operation log database. You can restore operation logs automatically or manually.

You can also restore operation logs of JP1/IT Desktop Management.

Tip

If the location you specified for Operation log backup folder during setup contains an operation log backup file for an old product version (JP1/IT Desktop Management), the tooltip Not restored (operation logs for old product versions) appears when you align your mouse with the time chart at the top of the Operations Log List view. In this case, the number of items is not displayed.

Tip

The maximum number of days of operation logs that can be restored to the database can be configured in the management server setup. The maximum is 500 days.

Automatic restoration

Operation logs are automatically restored according to the storage period specified in the Operation Log Settings in the Settings module.

On average, a managed computer generates 2,000 operation logs per day. Restoring an excessive amount of operation logs might overload the system. To prevent system overload, we recommend that you limit the types of operation logs to be collected, or reduce the number of managed computers.

Use the following formulas as a guideline for an operation that does not overload the system:

(a) Number of managed computers x 2,000 logs x Period for storing automatically restored operation logs (days) x x < 300,000,000

x: A coefficient depending on the collected operation log items. Specify the sum of the following items to be collected:

Start and termination of the programs: 0.26

File and folder operation: 0.06

Web access: 0.36

Window operation: 0.3

(b) Number of managed computers x Number of operation logs per day# < 60,000,000

#: It is the total number of operation logs and HIBUN logs. Operate your system for one week to one month before determining it because the number of HIBUN logs depends on the types of HIBUN logs to import and your environment.

This calculation is not necessary for non-bulky operation log types including power-on/shut-down, logon/logoff, file operations via a network, and print operation.

For example, if you want to collect operation logs for web accesses and window operations for 10,000 managed computers, the storage period is as follows:

10,000 computers x 2,000 logs x Period for storing automatically restored operation logs (days) x 0.66 < 300,000,000

Period for storing automatically restored operation logs (days) = 22.7 days ? about 1 month (20 business days per month)

Manual restoration

You can restore operation logs by specifying a time period that includes the operation log you want to investigate. You can also specify the target computer you want to restore operations logs from,

The maximum number of days of operation logs that can be manually restored to the database is calculated as Maximum number of days for which operation logs are to be stored in the database value (specified during the server set up) minus Period for storing automatically restored operation logs value (specified in the Settings module).

Tip

when you align your mouse with the time chart at the top of the Operations Log List view. It might take a long time for the number of operation logs that have not been acquired displayed on a tool tip displayed by mousing over a date on a time chart in the Operation Logs view of the Security module to be reflected.

Important

The backup files in the operation log backup folder are stored, based on the time zone on the management server. Therefore, if different time zones are used between the management server and the computer running the web browser, you must use the time zone on the management server when you specify a period for manual restoration of operation logs.

Important

The data that appears when you place a mouse cursor over a date on the time chart in the Operation logs view in the Security module are the status and the number of operation logs. Therefore, if different time zones are used between the management server and the computer running the web browser, the number of operation logs displayed on the tool tip and the number of operation logs filtered by a date might differ.

Important

Depending on the environment, it might take two or more hours to restore 3 months of operation logs for 200 computers. To reduce the time required for restoration, narrow the scope of restoration.

Important

When the number of days for which operation logs you want to manually restore in a day exceeds the maximum number of days for which operation logs can be manually restored in the database, you must set the maximum number of days for storing to the sum of the number of days for automatic restoration and the number of days for manual restoration per day.

Example: When the number of days for automatic restoration is 30 days and you want to manually restore operation logs for a half year (180 days) in a day, you must set the maximum number of days for storing to 210 days.

Operation log database

The size of the operation log database is expanded by the number of collected operation logs. Even if the operation log is deleted from the management screen, the size of the operation log database will not be reduced. When the operation log is deleted, it becomes free space in the database at the time of daily operation log database maintenance. This Free space is reused when collecting operation logs.

You can change the time to perform maintenance of the operation log database at the properties of the configuration file. For details about the properties of the configuration file, see A.5 Lists of properties.

(4) Periodically exporting operation logs

You can export collected operation logs in a CSV format when you want to save them in a CSV file, or import them to other systems. In the Operation Log Settings view in the Settings module, select the Periodically export operation logs. check box to export the operation logs to the export folder in the operation log backup folder every hour. The following describes the output information of the CSV file.

Output destination of the CSV file

operation-log-backup-folder\export

Output file name

oplog_YYYYMMDD_NNN.csv

YYYYMMDD: Date on which the periodic export was performed.

NNN: Serial number from 001 to 999. If the number exceeds 999, an event is generated.

The files are output in the order of the operation logs.

File size

A file is 2 GB or less. A file exceeding 2 GB is divided,

Character code

UTF-8

Output format

For details on the output format, see the description of the output format for the exported operation logs in the JP1/IT Desktop Management 2 Administration Guide.

Important

Because an output CSV file is not compressed, enabling periodic export of operation logs requires a large amount of disk space. Compress or back up the CSV files in other disks if necessary. For a guideline on the disk space required when periodically exporting output logs, see 4.5.3 Guidelines for disk space requirements for operation log backup folder.

(5) Additional cache of the operation log database

To increase the search performance of the operation logs, you can set a cache size when you set up the management server. Specify 1 GB for 2,500 managed computers.

Important

- If this option is enabled (1 GB or more) and a value lower than the recommended setting value is specified, setup may fail.

When enabling this option, specify the cache value (up to 16GB) according to the number of managed units.

(6) Recreating an index of the operation log database

To maintain search performance of operation logs, maintenance of the operation log database is carried out once a day (between 01:00 and 02:00).

Recreating the index of the automatically captured operation log

Deleting data that exceeds the storage period and release the area of the automatically captured operation log

Freeing the data area of the deleted manually captured operation log

Important

In the case of shutdown of the management server at night, please change the time of the maintenance, so that the maintenance of the operation log database is executed once a day

An operation log search operation might become slower during recreation of the index of the operation log database. Execute the operation log export command (ioutils exportoplog) after the index is recreated.

Tip

You can reduce the time spent on searching for operation logs by filtering the search target devices (for example, by group, location, source, or user name).

Related Topics:

A.8 Times at which functions are executed automatically

2.10.3 Investigating suspicious movements of files from systems using operation logs

You can collect computer user's operations as operation logs. Also, by setting the conditions for determining which operations are to be regarded as suspicious in a security policy, suspicious operations that might lead to information leakage can be detected automatically. You can check for operations that might lead to information leakage, and take appropriate actions before the damage expands.

The following figure shows the flow when operation logs are collected for investigation of suspicious operations.

To detect suspicious operations, you need to set the conditions for determining which suspicious operations to be reported in a security policy. Suspicious operations can be detected on a computer to which a security policy that defines these conditions has been applied.

If you detect that a file has moved out of a system, you need to investigate where the file was moved from to prevent confidential information leakage. When a suspicious operation is detected, it is reported as a Suspicious Operations event. You can check the event in the operation log, and track the source of the file that moved out of the system.

Tip

You can export operation logs by executing the ioutils exportoplog command. We recommend that you export operation logs when you want to use the contents of operation logs (for example, in documents).

Related Topics:

2.10.1 Types of operation logs that can be collected

(1) Collecting logs for suspicious movements of files from systems

JP1/IT Desktop Management 2 can automatically check the contents of operation logs, and monitor suspicious operations that might lead to information leakage due to file movement from a system.

In a security policy, specify the suspicious operations to be reported and set the conditions for those suspicious operations to be reported.

Suspicious operations to be reported:

A monitored file is attached to an email and sent to an email address#1, #2 set in the policy.

A monitored file is uploaded to a web server#1, #2, #3 or an FTP server#1, #2, #3 that is set in the policy.

A monitored file is copied or moved to external media.

A file to be monitored satisfies one of the following conditions:

A file received as an attachment of an email that was sent from an email address#1, #4 set in the policy

A file downloaded from a web server#1, #3, #4or an FTP server#1, #3, #4 that is set in the policy

A file newly created in the organization

A file that exists since before operation logs were collected

#1: Addresses that partially or completely match the specified address are applicable.

#2: When a monitored file is moved to an address that does not match any of the specified addresses, the operation is determined to be suspicious.

#3: If an IP address is specified, the IP address converted from the host name contained in the address of the downloaded file and an address that partially matches the specified IP address are applicable.

#4: When a file is moved from an address that does not match any of the specified addresses, the file is determined to be monitored.

When a monitored file is acquired, the operation of acquiring the file is not regarded as a suspicious operation. When a monitored file is moved from the system to outside, the operation is regarded as a suspicious operation, and an event is issued.

Example of monitoring emails with attachments

For example, configure the settings as shown in the figure below if you want to perform monitoring as follows:

Monitor movements of attached files to outside the company.

Do not monitor movements of attached files within the company (where the address hitachi.co.jp is used).

Example of monitoring a web server or FTP server

For example, configure the settings as shown in the figure below if you want to perform monitoring as follows:

Do not monitor uploading Web server A's data to outside because the data can be open to the public.

Monitor uploading Web server B's data to outside because the data is sensitive.

The products that support monitoring of suspicious operations are the same as the products that support collection of operation logs. For details, see the supported products described in #2, #3, and #4 in 2.10.1 Types of operation logs that can be collected.

Important

Suspicious operations can be correctly detected only when the file system of the target computer is NTFS. If the file system is not NTFS, the original file information is not set and suspicious operations might not be correctly detected.

2.10.4 Conditions for determining whether a file is to be monitored for suspicious file movements

When files are moved to an agent-installed computer from an external source or are moved from an agent-installed computer to an outside destination, they are checked to determine whether they are monitoring targets for suspicious operations. The following table shows the conditions for these checks.

Determining whether a file moved to a system is to be monitored for suspicious operations

Operation log collection item

Whether a file is to be monitored for suspicious operations

Copy file

C#1

Move file

C#1

Rename file

C#1

Create file

Y

Delete file

C#1

Web Access (Upload)

C#1, #2

Web Access (Download)

C#3

FTP (Send File)

C#1

FTP (Receive File)

C#3

Send Mail (Attachment File)

C#1

Receive Mail (Attachment File)

C#3

Save Attached File

C#1

Print

N

Legend: Y: The file should be monitored. C: The file should be monitored depending on certain conditions. N: The file does not need to be monitored.

#1: The file should be monitored when the drive is a local drive, remote drive, or RAM drive, or when the drive information cannot be collected. The file does not need to be monitored when the drive is a removable drive or CD-ROM drive.

#2: A file uploaded from Internet Explorer 10 or 11 and Microsoft Edge (IE mode) does not need to be monitored.

#3: The file should be monitored when the operation matches the conditions defined for monitoring targets, or when the operation does not match any of the conditions.

Determining whether movement of a file from a system is determined to be a suspicious operation

Operation log collection item

Whether an operation is determined to be a suspicious operation

Copy file

C#1

Move file

C#1

Rename file

N

Create file

C#2

Delete file

N

Web Access (Upload)

C#3, #4, #5

Web Access (Download)

C#6

FTP (Send File)

C#3

FTP (Receive File)

C#6

Send Mail (Attachment File)

C#3

Receive Mail (Attachment File)

N

Save Attached File

C#6

Print

N

Legend: C: An operation is determined to be suspicious depending on a certain condition. N: An operation is not determined to be suspicious.

#1: For the conditions, see the table Conditions for determining whether an operation is determined to be suspicious when a file is copied or moved from a system below.

#2: For the conditions, see the table Conditions for determining whether an operation of moving a file from a system is determined to be suspicious for file creation below.

#3: An operation is determined to be suspicious when the operation matches one of the conditions defined for determining suspicious operations or when the operation does not match any of the conditions.

#4: In Internet Explorer 10 or 11 and Microsoft Edge (IE mode), all the files are determined to be suspicious.

#5: In Internet Explorer 10 or 11 and Microsoft Edge (IE mode), a check for suspicious operation is performed when a file upload is started. Therefore, a suspicious operation can be detected even when an upload is interrupted by a communication error. For the conditions, see the table Conditions for determining whether an operation of moving a file from a system is determined to be suspicious for receive operations below.

#6: For the conditions, see the table Conditions for determining whether an operation of moving a file from a system is determined to be suspicious for receive operations below.

Conditions for determining whether an operation is determined to be suspicious when a file is copied or moved from a system

Source

Destination

Local drive

Remote drive

Removable drive

CD-ROM drive

RAM drive

Drive information cannot be collected

Local drive

N

N

C#

C#

N

C#

Remote drive

N

N

C#

C#

N

C#

Removable drive

N

N

N

N

N

N

CD-ROM drive

N

N

N

N

N

N

RAM drive

N

N

C#

C#

N

C#

Drive information cannot be collected

N

N

C#

C#

N

C#

Legend: C: An operation is determined to be suspicious depending on a certain condition. N: An operation is not determined to be suspicious.

Note: With the Citrix XenApp and Microsoft RDS server, the type of drive that exists on the source device is displayed as Other by the session at the connection destination. Copying or moving files to such drives does not constitute a suspicious operation.

#: An operation is determined to be suspicious when Copy/Move the File to External Device is selected in the security policy.

Conditions for determining whether an operation of moving a file from a system is determined to be suspicious for receive operations

Source

Destination

Local drive

Remote drive

Removable drive

CD-ROM drive

RAM drive

Drive information cannot be collected

Any source

N

N

C#

C#

N

C#

Legend: C: An operation is determined to be suspicious depending on a certain condition. N: An operation is not determined to be suspicious.

#: An operation is determined to be suspicious when Copy/Move the File to External Device is selected in the security policy.

Conditions for determining whether an operation of moving a file from a system is determined to be suspicious for file creation

Source

Destination

Local drive

Remote drive

Removable drive

CD-ROM drive

RAM drive

Drive information cannot be collected

No source

N

N

C#

C#

N

C#

Legend: C: An operation is determined to be suspicious depending on a certain condition. N: An operation is not determined to be suspicious.

#: An operation is determined to be suspicious when Copy/Move the File to External Device is selected in the security policy.

Related Topics:

2.10.1 Types of operation logs that can be collected

2.10.5 Collecting logs for suspicious print operations

Cases of an excessive number of print jobs can be treated as suspicious operations and collected in logs. To collect logs for suspicious print operations, you need to set the conditions for determining suspicious operations in a security policy. Suspicious print operations are detected for the computers to which this security policy is assigned. For details about the conditions for determining that the number of print jobs is excessive, see 2.10.6 Conditions for checking for large numbers of print jobs.

If suspicious print operations are detected, you need to investigate the relevant user name, the number of print jobs, and the times the print jobs were submitted to prevent confidential information leakage. When suspicious operations are detected, a Suspicious Operations event is reported. Based on this event, check the collected operation logs to determine whether the large number of print jobs is problematic considering information leakage or costs.

2.10.6 Conditions for checking for large numbers of print jobs

JP1/IT Desktop Management 2 can detect operations that might lead to information leakage through printing as suspicious operations. In a security policy, specify the suspicious operations to be reported and set the conditions for reporting suspicious operations.

Suspicious operations to be reported

Printing more than a specified number of pages

In print operations that were submitted by a user within one hour, if the total number of print pages exceeds the number of pages set in the security policy, those print operations are detected as suspicious operations. When suspicious operations are detected, the counter for the print pages is cleared. Therefore, if suspicious operations submitted by a user were detected within the previous hour, the count of print pages for the user restarts from the next print operation without including the print operations that were detected as suspicious.

As the number of print pages reported in an event, the total number of print pages in the previous hour is displayed regardless of whether suspicious print operations were detected.

If a computer is shut down, the page count for the print operations performed by a user before the shutdown is cleared and is not included in the total count of the number of print pages for suspicious operations or for an event after the computer restarts.

2.10.7 Prerequisites and notes on collecting operation logs

(1) Notes on collecting operation logs

Do not enable operation logs on a computer on which 64-bit OS is running and VMWare Server has been installed. If you enable operation logs, the guest OS for VMWare Server might not start.

If processing is forcibly terminated after operation log data was sent from an agent-installed computer to the management server and before the operation log is deleted from the computer, the same operation log data might be collected twice.

JP1_ITDM_Agent Monitor Control, which is the Operation Logs service on the agent machine, restarts at 2:00 a.m. every day. This restart is a default operation, and is not due to an error.

(2) Notes on power-on/shut-down operation logs

When an agent is overwrite-installed, a computer power-on/shut-down operation log is acquired.

If the Fast Boot feature is enabled in a computer running Windows Server 2019, Windows Server 2016, Windows 10, Windows Server 2012 R2, Windows 8.1, Windows Server 2012 or Windows 8, a power-on or shut-down operation log might not be acquired when the computer is started or shut down.

When a computer is shut down or rebooted while a user is still logged on, if the power turns off before the agent outputs the operation logs related to logging off, those logs cannot be acquired. To ensure that the operation logs related to logging off are acquired, log off before shutting down or rebooting the computer.

Related Topics:

2.10.1 Types of operation logs that can be collected

(3) Information and notes about operation logs for startup and blockage of programs

Startup and blocking of programs can be collected in operation logs only when the character string that starts the program (including the file name and the folder name) is less than 260 characters.

If a software program finishes its processing immediately after it starts up, startup and blocking of the program might not be collected because it might finish before it is blocked by the agent.

The startup of the programs that have any of the following file name extensions can be blocked:

exe

com

scr

If a program in the JP1/IT Desktop Management 2 - Agent-installation-folder#\bin folder cannot be started from the Start menu, startup and blocking of the program will not be collected in operation logs.

Startup and blocking of the following programs in the JP1/IT Desktop Management 2 - Agent-installation-folder#\bin folder will not be collected in operation logs.

cacls.exe

cmd.exe

conime.exe

cscript.exe

jdngsendinv.exe

jdngsetup.exe

netsh.exe

regsvr32.exe

secedit.exe

#: In the case of a management relay server in a multi-server configuration, the folder is JP1/IT Desktop Management 2 - Manager-installation-folder.

Related Topics:

2.10.1 Types of operation logs that can be collected

(4) Prerequisites for and notes on collecting web access operation logs

The following describes the prerequisites and notes when operation logs are collected for web accesses.

Prerequisites

For Internet Explorer, on the Advanced tab of the Internet Options dialog box, Enable third-party browser extensions must be selected. Note that in Internet Explorer installed on Windows Server 2019, Windows Server 2016, Windows Server 2012 and Windows Server 2008 R2, Enable third-party browser extensions is not selected by default.

The add-on for monitoring web accesses that is added to the user's computer must be enabled.

For Internet Explorer and Microsoft Edge (IE mode), in Toolbars and Extensions (which is displayed when you select Manage Add-ons from the Tools menu of Internet Explorer), the JP1/IT Desktop Management 2 BHO add-on must be enabled.

Tip

The following add-ons are added to Internet Explorer on the agent-installed computer:

- Add-on for Web access monitoring

- Add-on for file upload monitoring (in the case of Internet Explorer 10 or later and Microsoft Edge (IE mode))

Web accesses are monitored and detected by the add-on for web access monitoring. File uploads via HTML forms or Javascript are monitored and detected by the agent if the Internet Explorer version is 9 or earlier. Alternatively, file uploads are monitored and detected by the add-on for file upload monitoring if the Internet Explorer version is 10 or later and Microsoft Edge (IE mode).

Note that downloads, sending, and receiving of files are monitored and detected by the agent.

Notes

If you start a web browser when all add-ons are disabled, operation logs of web accesses cannot be collected.

When you open a file or folder in Internet Explorer and Microsoft Edge (IE mode), operation logs for the web access can be collected.

Images on a web page cannot be collected.

If multiple web accesses are performed within a second, the web accesses might not be collected in the operation logs.

If 15 or more Internet Explorer and Microsoft Edge (IE mode) programs are running at the same time, web accesses might not be collected in the operation logs.

If Internet Explorer and Microsoft Edge (IE mode) is started immediately after you log on to the Windows, web accesses might not be collected in the operation logs.

If the Enhanced Protected Mode is enabled in an environment using Internet Explorer 10 or 11, web access operation logs cannot be collected.

Even if an error occurs during a web access (for example, due to a communication error or because the accessed URL does not exist), operation logs for the web access might be collected.

Tip

When an add-on is registered, a confirmation message asking whether to enable the add-on is displayed. To avoid the behavior of displaying the message, perform the following steps and restart Internet Explorer.

Log in to an agent computer with a user that has administrator privileges, type gpedit.msc in Run, and start Group Policy Editor.

Open the Add-on List settings in the following location:

Local Group Policy Editor - Computer Configuration - Administrative Templates - Windows Components - Internet Explorer - Security Features - Add-on Management - Add-on List.

In the Add-on List dialog box, select Enable. In the activated Options, click Display in the Add-on List.

Add the following settings:

Value name: {90CA397B-DA51-47EB-9299-0B7041857FCB}

Value: 1

If the add-on is set to Disable, perform the following steps:

Perform the steps as described above.

In the Internet Explorer, Tools - Internet Options - Programs - Manage Add-ons, change the setting for JP1/IT Desktop Management 2 BHO to Enable.

Related Topics:

2.10.1 Types of operation logs that can be collected

(5) Information and notes about operation logs collected for file/folder operations

When a user copies, moves, or deletes a folder, information about the operations for all the files and subfolders in the folder can be collected. Note that when a folder is renamed, information about the operation cannot be collected.

Operation logs are collected for the operations performed using Windows Explorer. Therefore, operations performed at the command prompt or by the COPY command cannot be collected.

The following describes information about operation logs and notes when operation logs are collected for file or folder operations.

If a user performs an undo operation (by selecting the Undo menu or pressing the Ctrl + Z keys) immediately after a file or folder operation, any of the operation logs in the following table is collected.

Operation performed before an undo operation

Operation log collected during an undo operation

Copy

Indicates that the copied file or folder has been deleted.

Move

Indicates that the moved file or folder has been moved back to the original location.

Rename

Indicates that the file or folder has been renamed to the original name.

Delete

Indicates that the deleted file or folder has been moved back to the original location

When a file operation is performed, operation logs for file creation or deletion that is not directly related to the user's operations (such as operations in the Windows Recent Items folder) might be output. Therefore, operation logs that satisfy all the following conditions are not collected:

The operation is creating or deleting a file.

The file path includes either of the following folders:

%USERPROFILE%\Recent

%APPDATA%\Microsoft\Office\Recent

The file extension is .lnk.

Also, for operations (on files or folders under the installation folder for agent and agent for management relay server) that satisfy all the following conditions, operation logs are not collected:

The operation is creating, deleting, or renaming a file, or creating, deleting, or renaming a folder.

The file path is either of the following folders (including subfolders):

In the case of an agent:JP1/IT Desktop Management 2 - Agent-installation-foloder

In the case of an agent for management relay server:JP1/IT Desktop Management 2 - Manager-installation-foloder\bin

Notes

If a user repeatedly copies the same file or folder, information indicating that a file or folder was created might be collected.

When a user moves a file or folder to the Windows Recycle Bin, the information indicating that the file or folder was deleted (not moved) is collected.

When a user deletes a file or folder in the Windows Recycle Bin, the collected file name or folder name might be different from the name before deletion.

If a user deletes a large number of files in a batch, the history about the deletion of some of those files might not be collected.

If a user overwrite-copies or moves a large number of files or folders, information about some file operations might not be collected.

If a user overwrites a file in the destination folder when moving files, or if a user performs an undo operation (by selecting the Undo menu or pressing the Ctrl + Z keys) for file movement, excess information about deleting the source files might be collected, in addition to the information about moving files.

Information about the operations for compressed folders (in ZIP format) cannot be collected. However, information about some of such operations might be collected depending on the OS or user operations.

When the use of USB devices is restricted, information about the file operations on a USB-connected device might not be collected.

Information about operations of Windows portable devices cannot be collected. However, some operation information might be collected, depending on the OS or device.

On the agent-installed computers that security policies are applied with the operation log settings enabled, if you copy specific files at high speed for several times in a row (for example, Pressing Ctrl + V for multiple times), the last modified date of the files might be set to the date and time of copying. However it was originally designed to maintain the same date and time of the source files.

When the Create File, Delete File, or Rename File operation is performed on shared folder, if another computer with Agent installed is opening the same shared folder, the operation log of file operation is also acquired from that computer.

When the Move File operation is performed on shared folder, if another computer with Agent installed is opening the same shared folder, the operation log of Delete File is also acquired from that computer for the source file.

Information on the operation of writing data to a CD/DVD cannot be obtained.

To obtain information regarding take-out check in Citrix XenApp and Microsoft RDS environments, install JP1/IT Desktop Management 2 - Agent on the computer that is the remote connection source.

When the OS is Windows Server 2019, Windows Server 2016, Windows 10, Windows 8.1, Windows 8, Windows Server 2012, Windows 7, or Windows Server 2008 R2, in addition to the above notes, the following notes also apply:

Notes (Windows Server 2019, Windows Server 2016, Windows 10, Windows 8.1, Windows 8, Windows Server 2012, Windows 7, or Windows Server 2008 R2)

All operations

Even when an operation on a file or folder is performed by an application program or at the command prompt, operation logs for some operations might be collected.

Information about shadow copy operations and restoration operations from backup cannot be collected. However, some information might be collected.

Copy

When a file is overwritten by a copy operation, if Copy, but keep both files is selected in the Confirm File Replace dialog box, the following pieces of information are collected:

- Information indicating that the file name after copying became file-name-before-copying(n) (where n indicates a number) is collected.

- If the source file is deleted after copying, information about file movement might be collected additionally.

- If the last modified date and time of the source file is the same as the one of the overwritten file, information indicating that the file names were the same before and after copying is collected.

If the Confirm Folder Replace dialog box is displayed multiple times for one copy operation, excess history of copying the folder and files might be collected.

If a user copies a file or folder whose name includes parentheses (()), information might not be correctly collected.

If a user selects multiple files or folders whose names include (n) (where n indicates a number), and overwrite-copies the files or folders, selecting Copy, but keep both files in the Confirm File Replace dialog box, information might not be correctly collected.

If a user performs a redo operation (by selecting the Redo Copy menu or pressing the Ctrl + Y keys) after an undo operation, information about the file operation cannot be collected. Note that for a redo operation for a folder, information can be collected as a folder copy operation.

If a user copies a series of files or folders whose names include (n) (where n indicates a number), for the second or later copy operation, information is collected as creation of files or folders.

If a user selects multiple files or folders, or selects a folder that contains multiple files and folders, and then copies them, information about the operations might not be collected.

When a user cancels copying in the dialog box that confirms whether to perform an overwrite operation, if the latest modified date and time are the same for the source file and the file that has the same name as the source file in the destination folder, information is collected as a copy operation.

Move

When a file is overwritten due to a user's move operation, if the user selects Move, but keep both files in the Move File dialog box, information indicating that the name of the file after moving became file-name-before-moving(n) (where n indicates a number) is collected. Also, excess information indicating that the file names become the same before moving and after moving is collected.

When a user selects multiple files or folders whose names include (n) (where n indicates a number) and moves the files or folders, if Move, but keep both files is selected in the Confirm File Replace dialog box, information might not be correctly collected.

When a folder is overwritten due to a user's move operation, if the user confirms overwriting by clicking the Yes button in the Confirm Folder Replace dialog box, the following pieces of information are collected:

- If files with the same name exist in the source folder and the destination folder, when the folder is merged, only the files are moved and the folders in the source folder are not deleted. At this time, information indicating the folder copy operation is collected.

- If a user selects Move and replace when confirming overwriting of a file, and if the last modified date and time is the same for the source file and the overwritten file, information indicating file copy and delete operations (not a file move operation) is collected.

- If a user selects Move, but keep both files when confirming overwriting of a file, information indicating that the name of the file after moving became file-name-before-moving(n) (where n indicates a number) is collected. If the last modified date and time is the same for the file before moving and the overwritten file, excess information indicating the file copy and delete operations is collected in addition to the information indicating the file move operations. If the last modified date and time is different for the source file and the overwritten file, excess information indicating that the file names became the same for the source file and the destination file is collected.

- In Windows 7 or later, if a file is moved from a folder that needs elevation of permissions to a drive whose file system is other than NTFS, the type of the original drive might not be collected and the file might not be tracked correctly.

Rename

When a folder is overwritten due to a rename operation performed by a user, the Confirm Folder Replace dialog box is displayed. If the user clicks the Yes button in this dialog box, the following pieces of information are collected:

- If a user renames a folder that contains some files, operation logs for creation of the files in the overwritten folder and operation logs for deletion of the files in the source folder are collected. An operation log for deletion of the source folder is not collected. If no files are contained in the source folder, only the operation logs for creation of the subfolders in the new folder are collected.

- If subfolders with the same name exist in the source folder and in the destination folder, information indicating the creation of the subfolders is collected. At this time, information indicating the deletion of the source folder is not collected.

- If multiple files or subfolders exist in the source folder, information about some of the file operations might not be collected.

- Information about operations for the files in the subfolders of the source folder might not be collected.

If a user select multiple files or folders, or a folder that contains multiple files and folders and then renames the files and folders in a batch, information about those operations might not be collected.

Delete

If a user performs an undo operation or selects the Undo menu after deleting a file, information about the operation of creating the deleted file at the original location, and information about the operation of deleting the file from the Windows Recycle Bin are collected. However, for the information about the operation of deleting the file from the Windows Recycle Bin, the file name cannot be correctly collected.

If a user moves a file from the Windows Recycle Bin after deleting the file, information about the operation of moving the deleted file to the original location is collected.

Assume that a user select multiple files or folders, or a folder that contains multiple files and folders, delete them, and then select the Undo or move the folder or folders from the Windows Recycle Bin. In this case, information about those operations might not be collected.

Related Topics:

2.10.1 Types of operation logs that can be collected

(6) Notes on collecting operation logs for file uploads and downloads

Operations for uploading or downloading files on a web browser can be monitored, and the operation logs for those operations can be collected. The following describes the notes you must keep in mind when collecting operation logs for uploading or downloading files.

Prerequisites

If your Web browser is Internet Explorer 10 or 11 and Microsoft Edge (IE mode), the Enable third-party browser extensions check box must be selected on the Advanced Settings tab in Internet Options. Note that this check box is cleared by default for Internet Explorer installed in Windows Server 2019, Windows Server 2016, Windows Server 2012 and Windows Server 2008 R2.

If your Web browser is Internet Explorer 10 or 11 and Microsoft Edge (IE mode), the add-on for upload monitoring that is added to the user's computer must be enabled.

If you register the add-on in Internet Explorer for file upload monitoring, a message prompting you to select if you want to enable the add-on appears. If you enable the add-on and restart Internet Explorer, file upload monitoring starts.

If your Web browser is Internet Explorer 10 or 11 and Microsoft Edge (IE mode), the JP1/IT Desktop Management 2 FUO add-on must be enabled in the list of add-ons displayed by selecting Tools, Manage Add-ons, and then Toolbars and Extensions in Internet Explorer.

Notes

For web uploads executed by unusual upload processing (such as SOAP, WebDAV, Flash, Silverlight), operation logs are not collected.

If the folder for storing the internet temporary files for Internet Explorer is changed, operation logs might be collected even if no web download operation is performed. To collect operation logs correctly, immediately restart Internet Explorer.

If the Enhanced Protected Mode is enabled in an Internet Explorer 10 or 11 environment, operation logs for file uploads and downloads cannot be collected.

In Internet Explorer 9, an operation log is collected when uploading of a file is completed. In Internet Explorer 10 and 11 and Microsoft Edge (IE mode), an operation log is collected when uploading of a file is started. Therefore, in Internet Explorer 10 and 11 and Microsoft Edge (IE mode), an operation log can be acquired even when the uploading operation is interrupted by a communication error or other cause.

If a user uploads multiple files simultaneously to an HTML5 upload site by using Internet Explorer 10 or 11 and Microsoft Edge (IE mode), an operation log for only a single file is acquired.

When a user uploads a file by using Internet Explorer 10 or 11 and Microsoft Edge (IE mode), if encoding differs between the Web page from which data was uploaded and the data sent from the browser to the destination, the file name in the acquired operation log will become garbled. If garbling occurs when, for example, encoding conversion fails, the file name of the operation log will become unknown.

If a file download destination is a FAT file system, file download logs can be output duplicately.

The message "File-name could not be downloaded" may appear. In this case, download the file again.

If you store a PDF file after opening it on Internet Explorer and Microsoft Edge (IE mode), the operation logs of Web Access (Download) might not be collected. With the operation logs of Web Access, you can monitor the operation to open a PDF file on Internet Explorer.

Tip

When the add-on is registered in Internet Explorer, a confirmation message asking whether to enable the add-on is displayed. To avoid this behavior of displaying the message, perform the following steps and restart Internet Explorer.

Log in to a computer as a user that has administrator privileges, type gpedit.msc in Run, and start Group Policy Editor.

Open the Add-on List settings in the following location:

Local Group Policy Editor - Computer Configuration - Administrative Templates - Windows Components - Internet Explorer - Security Features - Add-on Management - Add-on List

In the Add-on List dialog box, select Enable. In the activated Options, click Display in the Add-on List.

Set the following values in the displayed dialog box.

Value name: {A36BDD30-8AF5-48AE-AFB9-866F89D167A5}

Value: 1

If the add-on is set to Disable, enable the add-on by performing either of the following steps:

Perform the above steps which avoid this behavior of displaying the message.

In the Internet Explorer, Tools - Internet Options - Programs - Manage Addons, change the setting of JP1/IT Desktop Management 2 FUO to Enable.

Related Topics:

2.10.1 Types of operation logs that can be collected

(7) Information and notes about operation logs collected when emails are sent and received

Among the emails sent and received by users via email clients, you can collect operation logs for the operations of sending and receiving emails with attachments. The following provide information and notes about when operation logs are collected for the operations of sending and receiving emails.

The following table shows the email clients for which operation logs can be collected.

Email client

Version

Microsoft Outlook

2002

2003

2007

2010

2013

2016

2019

Windows Live Mail

2009, 2011, or 2012

The table below shows the email operations for which operation logs can be collected. Note that when multiple attached files are sent or received, operation logs are collected for individual attached files.

Email operation that can be collected

Protocol

Receive

POP3, APOP, or IMAP4

Send

SMTP or ESMTP

Notes

If communication is encrypted by SSL/TLS (such as SMTP over SSL or POP3 over SSL), operation logs are not collected.

If emails are encrypted by S/MIME encryption, PGP encryption, or other encryption methods, operation logs cannot be collected.

When an email is sent, if multiple files with the same contents are attached to the email, information about the files moved from the system is not correctly collected. For the operation source file name and the drive type, the name of the file last loaded among the attached files with the same contents and the drive type are displayed.

If an email to which a file with zero bytes is attached is sent, the operation source file name might be different from the name of the file actually sent.

If emails sent in TNEF format of Microsoft Outlook are sent or received, information about the attached files might not be correctly collected in the operation logs for the operations of sending and receiving emails. Therefore, file tracking or detection of suspicious file movements from the system might not be possible.

If the number of attached files per email exceeds 200, it might not be possible to collect operation logs.

If Content-type in the MIME header is either of the following, the attachment is not treated as an attached file:

application/pkcs7-mime, application/pkcs7-signature, or application/pkcs10 (digital signature)

multipart/alternative (such as HTML mails)

Related Topics:

2.10.1 Types of operation logs that can be collected

(8) Notes on collecting operation logs when attached files are saved

You can collect operation logs when attached files are saved from an email a user received using a specific mailer to a local disk or another location. Listed below are some notes on operation logs that are collected for the operations of saving attached files.

The following table shows the email clients for which operation logs can be collected.

Email client

Version

Microsoft Outlook

2002

2003

2007#

2010#

2013#

2016#

2019#

Windows Live Mail

2009, 2011, or 2012

#: If attached files are saved with the network drive specified as the destination, file names that are different from the saved file names will be collected as the destination file names in the operation logs.

Notes

When an email (to which multiple files with the same contents are attached) is received and the attached files are saved, the name of the file last received among the attached files with the same contents will be displayed as the operation source file name.

In Windows 7 or later, if either of the following operations is performed in the email client's window, operation logs for saving attached files might not be collected.

Select attached files, and drag and drop the files to Windows Explorer or the Desktop.

Select files, click Copy, and then Paste to save the files.

If attached files are saved from an email that was received before collection of operation logs started, the operation logs for the operations of saving the attached files will not be collected.

If emails in TNEF format of Microsoft Outlook are received, operation logs for the operations of saving attached files might not be collected correctly.

If the number of attached files per email exceeds 200, it might not be possible to collect operation logs.

If Content-type in the MIME header is either of the following, the attachment is not treated as an attached file:

application/pkcs7-mime, application/pkcs7-signature, or application/pkcs10 (digital signature)

multipart/alternative (such as HTML mails)

Related Topics:

2.10.1 Types of operation logs that can be collected

(9) Notes on collecting operation logs when files are sent and received

You can collect operation logs when a user accesses an FTP site via a web browser and sends or receives files. For the supported web browsers, see the table of prerequisites in 2.10.1 Types of operation logs that can be collected. The following are notes on when operation logs are collected for the operations of sending and receiving files.

Notes

If FTP over SSL/TLS is used when files are sent or received, operation logs cannot be collected.

If the Enhanced Protected Mode is enabled in an Internet Explorer 10 or 11 environment, operation logs for FTP receive operations cannot be acquired.

The URL is collected as the operation source file name when an operation log for file reception is acquired using Internet Explorer.

As the destination file information in the operation log for FTP send operations, the IP address of the FTP server is collected.

If the Enhanced Protected Mode is enabled in an Internet Explorer 10 or 11 environment, operation logs for FTP receptions cannot be collected.

Related Topics:

2.10.1 Types of operation logs that can be collected

(10) Information about, prerequisites for, and notes on operation logs collected for print operations

You can collect operation logs for print operations. The table below shows the printers for which operation logs for print operations can be collected. Note that only the printers set in the Devices and Printers dialog box are supported. Note that the printers displayed in the Devices and Printers dialog box can be commonly used by all users.

Printer type

Collection of operation logs for print operations

Local printer

Y

Network shared printer

Y #

Internet printer

N

Virtual printer

Y

Legend: Y: Operation logs can be collected for this type of printer. N: Operation logs cannot be collected for this type of printer.

#: Information about the number of print pages cannot be collected.

Prerequisites

In the properties for each printer, Print and Manage Documents must be allowed for all logged on users.

For the network shared printer, the following prerequisites are added.

The table below shows the supported combination of the agent and the print server.

Agent

Print server

Collection of operation logs for print operations

Windows 7 or later

Windows XP/2003

N

Windows 7 or later

Windows Vista or later

Y

Any

Others

N

Legend: Y: Operation logs can be collected for this type of printer. N: Operation logs cannot be collected for this type of printer.

RPC communication must be possible between the print server and the agent PC. If RPC communication is not possible, the problem might be caused by one of the following:

The print server is a server based on the Internet Printing Protocol (IPP).

A firewall, proxy or NAT is present between the print server and the agent PC.

The agent PC's Windows firewall is enabled and File and Printer Sharing is not set to Exceptions.

The agent PC's File and Printer Sharing for Microsoft Networks must be enabled.

The print server must be able to resolve the name of the agent PC.

If the agent PC is Windows 7 or later, the agent PC and the print server must join the same domain, or the credential of the print server must be registered on the Credential Manager of the agent PC. The agent PC needs to reboot after registering the credential.

Notes

If printing is restricted by Hibun, operation logs for print operations cannot be collected.

If printing is performed immediately after a printer is added, it might not be possible to collect operation logs for print operations.

If printing is performed immediately after you log on to the OS, it might not be possible to collect operation logs for print operations.

If a print job is finished before the print operations are notified to the agent, operation logs for print operations cannot be collected.

Depending on the printer, multiple printing restriction logs are collected at a single printing.

For the network shared printer, the following notes are added.

If IPv6 is enabled and rendering of the print job does not work on the client computer, the printing might not be restricted. To operate rendering of print jobs on the client computer, the following settings are required:

Render print jobs on client computers is enabled.

Enable advanced printing features is enabled.

When a network shared printer is used, information about the number of print pages cannot be collected. Therefore, the detection of large numbers of print jobs and the report of User Activity (Print) are out of scope.

Related Topics:

2.10.1 Types of operation logs that can be collected

(11) Notes on collecting logs for device operations

If prohibited operations are set, you can also collect operation logs for device connection suppression and device connection permission.

Logs of inserting or ejecting media (such as CDs, DVDs, SD cards) into or from drives cannot be collected. The following notes are about collecting operation logs of device operations.

Notes

Console session users are regarded as the target users. If no one is using a console session, no account name can be collected.

If a device is connected to the computer for the first time, multiple instances of connecting and disconnecting (detaching) information might be acquired for a single connection.

If you detach a device from a computer running Windows Server 2019, Windows Server 2016, Windows 10, Windows Server 2012 R2, Windows 8.1, Windows Server 2012 or Windows 8 with the Fast Boot feature enabled while the computer is shutting down, a device disconnection operation log is acquired when the computer is restarted.

Items might be missing in device connection logs, disconnection logs, block device connections logs, and events acquired in a condition where the device is restricted.

An operation log cannot be acquired if a device is connected before JP1/IT Desktop Management 2 is started (for example, immediately after the computer is turned on).

If a device with multiple device instance IDs is connected to a computer, multiple operation logs and events are acquired for the single device. However, only one operation log and event might be acquired when the device is disconnected.

If you connect a device to a computer for the first time, and drive installation is performed, the same operation log and event might be acquired multiple times.

In a case where a restart of the computer is required to activate a setting, the connection suppression logs, and connection suppression events are acquired when you apply the setting.

An operation log is also acquired when the device setting is changed by another product, and the system detects connection or disconnection of the device.

If a USB device is connected, operation logs cannot be acquired for devices that are not identified as a USB device, Bluetooth device, or imaging device.

Multiple logs might be acquired if you connect a CD/DVD drive that has a CD or DVD inserted.

In a case where a restart of the computer is required to activate the deterrence of a device, deterrence logs, disconnection logs, and events are not acquired for the deterrence-target device.

If a log-acquisition-target device is identified by the OS as a different device, operation logs for the device cannot be acquired. However, if the OS identifies it as another log-acquisition-target device, the device is restricted according to the OS identification.

If you change the deterrence setting on the same device a number of times in a short period of time, connection logs and disconnection logs might not be acquired.

With the Citrix XenApp and Microsoft RDS server, the type of drive that exists on the source device is displayed as Other by the session at the connection destination. An operation log of connecting a device to the computer and disconnecting it from the computer cannot be acquired for such drives.

To obtain the operation log of Device Attach/Detach in Citrix XenApp and Microsoft RDS environments, install JP1/IT Desktop Management 2 - Agent on the computer that is the remote connection source.

Related Topics:

2.10.1 Types of operation logs that can be collected

(12) Notes on collecting operation logs for window operations

You can collect operation logs for window OS operations in the following cases:

When a window starts and becomes active.

When the active window is switched by a mouse operation or because the Alt + Tab keys are pressed.

When a new window starts during window operations and that window becomes active.

The followings are notes on collecting operation logs for window operations.

Notes

If operation logs for window operations are collected immediately after logon, the logon user name might become null.

For a window that is created by an application and first displayed without a title and then the title is set, the window title is not collected.

Related Topics:

2.10.1 Types of operation logs that can be collected

(13) Prerequisite for collecting source information when checking incoming files and notes on suspicious out-movement of files

You can collect information about the input source of a file when the file is moved to an agent-installed computer. The following are a prerequisite for collecting source information when checking incoming files and notes on suspicious out-movement of files.

Prerequisite

The file system on an agent-installed computer must be NTFS 5.0 or later.

Notes

If a security policy where any of the following is enabled, agents add tracking information and information about suspicious operations to the files to be operated when an operation for a file is performed.

Operation Logs - Only operations that divulge information (recommended)

Any of Copy File, Move File, Rename File, Create File, Delete File, Web Access (Upload), Web Access (Download), FTP (Send File), FTP (Receive File), Send Mail(Attachment File), Recieve Mail(Attachment File), and Save Attached File of Operation Logs - Target Operations to be Logged

Any of Send/Receive E-mail with Attachments, Use Web/FTP Server, and Copy/Move the File to External Device of Operation Logs - Suspicious Operations To Be Reported

When you move or copy a file where tracking information and information about suspicious operations are added by agents to a drive that was formatted by a file system other than NTFS (such as FAT or ReFS), the dialog that indicates properties of Windows have been lost.

If you continue to move or copy the file in the dialog that indicates properties of Windows have been lost, tracking information and information about suspicious operations are deleted from the move or copy destination file. Therefore, when you bring out the moved or copied file to external media, suspicious operations by bringing out a file cannot be correctly detected. Also, the case that you process data by compressing or expanding files is identical.

To avoid display of the dialog that indicates properties of Windows have been lost, before applying a security policy to acquire operation logs and suspicious operations for a computer where an agent is installed, specify the following value to the registry.

Key name

For 32-bit OSs

HKLM\SOFTWARE\HITACHI\JP1/IT Desktop Management - Agent

For 64-bit OSs

HKLM\SOFTWARE\Wow6432Node\HITACHI\JP1/IT Desktop Management - Agent

Value name

JdngSmcStopWriteTrackingInfo

Type

REG_SZ

Data

1

You can use this option in JP1/IT Desktop Management 2 - Agent 11-51-02 or later.

By specifying this option, agents become not adding tracking information and information about suspicious operations to a file. Therefore, the following information becomes not being acquired:

Tracking information of operations for files

A result of security determination of suspicious operations for the following operations for files

Copy/Move the File to External Device

Web Access (Upload)

FTP (Send File)

Send Mail (Attachment File)

If tracking information and information about suspicious operations have already been added to a file before enabling this option, when you move or copy the file to a drive that was formatted by a file system other than NTFS, the dialog that indicates properties of Windows have been lost is displayed.

To disable this option, delete the above registry or set the value to 0.

Related Topics:

2.10.1 Types of operation logs that can be collected

2.10.8 Importing HIBUN logs into the management server

If the product links with HIBUN version 10-00 or later versions, you can import HIBUN logs into JP1/IT Desktop Management 2.

The imported HIBUN logs can be examined in the Operations Logs view of the Security module, together with JP1/IT Desktop Management 2 operation logs.

(1) List of the information leak prevention functions of JP1/IT Desktop Management 2 and HIBUN

You can prevent information leaks by combining the functions of JP1/IT Desktop Management 2 and HIBUN. The following table lists the information leak prevention functions of JP1/IT Desktop Management 2 and HIBUN.

Information leak prevention function

JP1/IT Desktop Management 2 function

HIBUN function

Prevent unauthorized taking out of data

Restrict prohibited operations

Printing Restriction

Restriction of Device Usage

Software Restriction

Watch suspicious operations

Large Number of Printing Jobs

Data-reproduction control

Device control

Permitted network control

Keep logs of file operations by users of computers

Keep logs of operations

File Operation/Print Operation

Folder Operation

Watch suspicious operations

Send/Receive E-mail with Attachments

Use Web/FTP Server

Copy/Move the File to External Device

Acquiring HIBUN extended operation log

File operation log

Drive operation log

Keep logs of window operations and Web access by users of computers

Keep logs of operations

Window Operation

Web Access

Acquiring HIBUN extended operation log

Application operation log

Keep logs of startups and shutdowns of computers and logons to and logoffs from computers

Keep logs of operations

Startups and shutdowns of computers, and logons to and logoffs from computers

Acquiring event log

Keep logs of access to devices and logs of starting and stopping programs

Keep logs of operations

Program Execution/Termination

Device Operation

Restriction log

Acquiring access log

Important

If you use the same information leak prevention function in both JP1/IT Desktop Management 2 and HIBUN, the same operation log can be displayed in the Operation Log List view.

If you use a function listed in the row of Keep logs of file operations by users of computers, use either a JP1/IT Desktop Management 2 function or a HIBUN function alone. Do not use both functions together.

If the Only operations that divulge information (recommended). check box is selected in the policy for operation log, do not use the HIBUN functions listed in Keep logs of file operations by users of computers.

If you want to use these HIBUN functions, clear the Only operations that divulge information (recommended). check box in the policy for operation log.

Do not use both functions together.

(2) HIBUN logs that can be imported into JP1/IT Desktop Management 2

The table below describes the types of HIBUN logs that can be imported into JP1/IT Desktop Management 2. Use a CSV-format file for HIBUN logs.

Type of HIBUN log

Description

Access log

Access operations performed on HIBUN clients by users, such as access to the shared confidential folder or taking out a file to a removable media including a USB memory device

Operations performed on HIBUN clients by programs, such as starting or exiting programs

Event log

History of events that occurred on HIBUN clients, such as logins, logouts, and password changes

HIBUN extended operation log

Logs of application and file operations performed on client PCs by users

(3) Importing HIBUN logs

For details about how to importing HIBUN logs, see the description about importing HIBUN logs in the JP1/IT Desktop Management 2 Administration Guide.

Storing the storage location of the operation logs

As with the operation logs collected by JP1/IT Desktop Management 2, the HIBUN logs imported into JP1/IT Desktop Management 2 are stored in the storage location of the operation logs. If you enable the automatic restoration of HIBUN operation logs, the logs can be imported automatically into the operation log database. After the operation logs are stored in the backup folder, you can view them by importing them from that folder into the database.

How the data is stored

The HIBUN logs are stored in different folders depending on the type of log and the date, as shown below.

operation-log-backup-folder-specified-in-the-setup\EXLOG\type-of-log\date-of-operation(YYYYMMDD)

Disk space needed for storage

For details, see 4.5.3 Guidelines for disk space requirements for operation log backup folder and 4.5.4 Guidelines for disk space requirements for the operation log database.

Importing into the operation log database

You can view the HIBUN logs after they are imported into the operation log database. As with the operation logs collected by JP1/IT Desktop Management 2, you can use the automatic restoration and manual restoration.

Automatic restoration

The HIBUN logs are imported according to the period for storing logs specified in Settings for Operation Logs of the Settings module.

Manual restoration

You can import the HIBUN logs from the storage location of the operation logs by specifying the period in which the operation log you want to examine is included. You can also import them by specifying a target computer.

Related Topics:

(2) Backing up operation logs on the management server

(3) Restoring operation logs to the management server

(4) Viewing HIBUN logs imported into JP1/IT Desktop Management 2

HIBUN logs imported into the operation log database of JP1/IT Desktop Management 2 are displayed in the Operation Log List view of the Security module. The following table lists and describes what items are displayed:

Display item in the Operation Log List view

When HIBUN logs are displayed

Trace button

Becomes unavailable.

Suspicious Operations column

Becomes empty.

Operation Date/Time (Browser) column

Operation Date/Time (Source) column

Operation Time (Source) column

The following date and time are displayed with the time zone for JP1/IT Desktop Management 2 - Manager:

Access log

Access date and time

Event log

Date and time when the event occurred

HIBUN extended operation log

Date and time when the log was created

Source column

Displays the name of the client computer that created the log. When the source can be identified as the device information managed by JP1/IT Desktop Management 2, it is displayed as a link. When you click the link, the Device Inventory view is displayed.

Operation logs of JP1/IT Desktop Management 2 are displayed as fully-qualified domain names (FQDNs) of computers. Therefore, these names may be different from computer names that were output in the HIBUN logs.

Host ID column

When the host ID can be identified as the device information managed by JP1/IT Desktop Management 2, it is displayed as the host ID of the device.

When it is not identified, the column will be empty.

User Name column

Displays the Windows user name.

Operation Type column

See What is displayed in Operation Type.

Operation Type (Detail) column

See What is displayed in Operation Type (Detail).

Target column

The following information is displayed:

Access log

The file name is displayed. However, the process name is displayed for Process generation, Process permission update, and Process termination.

Event log

The target of the event is displayed.

HIBUN extended operation log

The file name is displayed.

For clipboard action logging, copy storage file name or pasted data storage file name may be view. For more information about these file, see the HIBUN manual.

Operation Details column

The following information is displayed:

Access log

Status, Process name, Message 1, Message 2, and Message 3 are displayed, separated by commas (,).

Event log

Status

HIBUN extended operation log

Status, Process name, Message 1, Message 2, and Message 3 are displayed, separated by commas (,).

File Created Date/Time column

File Last Modified Date/Time column

Original File Created Date/Time column

Becomes empty.

File Size column

Destination File Drive Type column

Are displayed only for file operation logs of the HIBUN extended operation log. These must be configured in HIBUN.

Printed Page Count column

Becomes empty.

Serial # column

Is displayed for the device connection log. It is also displayed for the device-specific log and when the action value in the HIBUN log is CFL, OPN, WRI, DEL, CDR, DDR, or REN. It must be configured in HIBUN.

If the serial number is assigned automatically by the OS, [*] is appended to the number.

Device Category column

Is displayed only for the device connection log.

Identifying the computer name in the HIBUN log with the host name of the device

When a HIBUN log is imported, the computer name in the HIBUN log is associated with the host name of the JP1/IT Desktop Management 2 device. When it is successfully associated with (identified with) the host name, the HIBUN log is related to the JP1/IT Desktop Management 2 device. If the association (identification) fails, the host ID is not displayed for the HIBUN log in the Operations Logs view of the Security module.

What is displayed in Operation Type

What is displayed in Operation Type

Log type value in the HIBUN access log or HIBUN extend operation log

Searched Filter

[HIBUN]Access to an encrypted file

MYS

Operated File name (Operation Type is File Operation)

[HIBUN]Access to a network or controlled media

RES

Operated File name (Operation Type is File Operation)

[HIBUN]Access to a permitted controlled media (encrypted file)

CMD

Operated File name (Operation Type is File Operation)

[HIBUN]Access to a permitted controlled media (unencrypted file)

PMD

Operated File name (Operation Type is File Operation)

[HIBUN]Access to internal hard disk

NRD

Operated File name (Operation Type is File Operation)

[HIBUN]Output to a printer

PRT

Printed document name (Operation Type is Print Operation)

[HIBUN]Access for HIBUN data reproduction, or creation of a HIBUN confidential file

VFL

Operated File name (Operation Type is File Operation)

[HIBUN]Access to a shared confidential folder

NET

Operated File name (Operation Type is File Operation)

[HIBUN]Access for data reproduction by email

TCP

[HIBUN]Connection of a device

CON

Device name (Operation Type is Device Operation)

Device categorye (Operation Type is Device Operation)

[HIBUN]Network access

NAC

[HIBUN]File protection

EFP

[HIBUN]Program start/exit

CLS

Process name (Operation Type is Process/Program Operation)

[HIBUN]Malware detection (CylancePROTECT)

CYL

[HIBUN]Event logs

--

[HIBUN]Application operation logs

OMA

Window title (Operation Type is Window Operation)

[HIBUN]File operation logs

OMF

Destination File Drive Type (Operation Type is File Operation)

Operated File name (Operation Type is File Operation)

[HIBUN]Remote desktop connection operation log

OMR

[HIBUN]Browser operation log

OMB

URL (Operation Type is Web access)

[HIBUN]Clipboard operation log

OMC

Unknown

--

Legend: --: Not applicable

What is displayed in Operation Type (Detail)

What is displayed in Operation Type (Detail)

Action value in the HIBUN log

Type of the HIBUN log

[HIBUN]A file was opened, created, or printed.

CFL

A

[HIBUN]A file was opened.

OPN

A

[HIBUN]A file was opened, or a file was opened in write mode.

WRI

A

[HIBUN]A file was deleted.

DEL

A

[HIBUN]A folder was created.

CDR

A

[HIBUN]A folder was deleted.

DDR

A

[HIBUN]The name of a folder or a file was changed, or a folder or a file was moved to a location on the same drive. Alternatively, a folder was moved within a shared confidential folder.

REN

A

[HIBUN]A shared confidential folder was copied.

CPD

A

[HIBUN]A subfolder in a shared confidential folder was moved to a folder other than a local folder.

MVD

A

[HIBUN]A file was copied by the replicated file acquisition functionality.

CPY

A

[HIBUN]CD/DVD authoring software was started.

MED

A

[HIBUN]HIBUN data reproduction (outside use)

VFO

A

[HIBUN]HIBUN data reproduction (view-only)

VFV

A

[HIBUN]HIBUN data reproduction (HIBUN unencrypted-data reproduction)

VFP

A

[HIBUN]A HIBUN confidential file was created.

ARC

A

[HIBUN]An email was sent.

MAL

A

[HIBUN]Connection of removable media

REM

A

[HIBUN]Connection of an external hard disk

EXD

A

[HIBUN]Connection of a CD or DVD drive

CDD

A

[HIBUN]Connection of an infrared device

IRD

A

[HIBUN]Connection of a Bluetooth device

BTH

A

[HIBUN]Connection of a wireless LAN

WLN

A

[HIBUN]Connection of a modem

MDM

A

[HIBUN]Connection of an imaging device

IMG

A

[HIBUN]Connection of a Windows portable device

WPD

A

[HIBUN]Connection of a Windows Mobile device

WML

A

[HIBUN]Connection of a Palm handheld device

PLM

A

[HIBUN]Connection of a BlackBerry device

BBY

A

[HIBUN]Connection of a serial or parallel port

SPP

A

[[HIBUN]Other connection of a controlled device

OTR

A

[HIBUN]Connection of a Wired LAN (USB connections)

ULN

A

[HIBUN]Connection of a Wired LAN (non-USB connections)

OLN

A

[HIBUN]Wired LAN connection

LCN

A

[HIBUN]Wireless LAN connection (network communication (TCP/IP) log)

WCN

A

[HIBUN]Reconnection via roaming to wireless LAN

WRA

A

[HIBUN]Network communications (TCP/IP)

COM

A

[HIBUN]File access

CRF

A

[HIBUN]Network Communication

NWA

A

[HIBUN]Process creation

CRP

A

[HIBUN]Process permissions update

UPP

A

[HIBUN]Process termination

TEP

A

[HIBUN]Program file load

LOD

A

[HIBUN]Malware detection event occurrence (CylancePROTECT)

MDE

A

[HIBUN]Memory protection event or script prohibition event occurrence (CylancePROTECT)

MWE

A

[HIBUN]Other event occurrence (CylancePROTECT)

COE

A

[HIBUN]Unknown event occurrence (CylancePROTECT)

CUK

A

[HIBUN]Login to HIBUN DC or HIBUN DE

LOGIN

E

[HIBUN]Logout of HIBUN DC or HIBUN DE

LOGOUT

E

[HIBUN]Failure to log in to HIBUN DC or HIBUN DE

LOGERR

E

[HIBUN]Login to HIBUN DE (FS)

FSLOGIN

E

[HIBUN]Logout of HIBUN DE (FS)

FSLOGOUT

E

[HIBUN]Failure to log in to HIBUN DE (FS)

FSLOGERR

E

[HIBUN]Login to HIBUN IC

ICLOGIN#

E

[HIBUN]Logout of HIBUN IC

ICLOGOUT#

E

[HIBUN]Login to HIBUN IS

ISLOGIN#

E

[HIBUN]Logout of HIBUN IS

ISLOGOUT#

E

[HIBUN]Failure to log in to HIBUN IS

ISLOGERR#

E

[HIBUN]Login to HIBUN IF

IFLOGIN#

E

[HIBUN]Logout of HIBUN IF

IFLOGOUT#

E

[HIBUN]Failure to log in to HIBUN IF

IFLOGERR#

E

[HIBUN]Executing an administrator's command

MNGCMD#

E

[HIBUN]Changing a client setting

CNFUPDATE#

E

[HIBUN]Changing the password for HIBUN DC, HIBUN DE (FS), HIBUN IF, or HIBUN IS

CHGPASLOC

E

[HIBUN]The screen was locked.

SCLOCK

E

[HIBUN]Screen locking was canceled.

SCUNLOCK

E

[HIBUN]The terminal was locked.

PCLOCK

E

[HIBUN]Terminal locking was canceled.

PCUNLOCK

E

[HIBUN]Type-based device control settings update

DEVUPDATE

E

[HIBUN]Permitted network control settings update

NETUPDATE

E

[HIBUN]Switch to office mode

INTCHG

E

[HIBUN]Switch to public mode

EXTCHG

E

[HIBUN]File protection settings update

EFPUPDATE

E

[HIBUN]PC startup

PON

E

[HIBUN]PC shutdown

POF

E

[HIBUN]Windows logon

WSI

E

[HIBUN]Windows logoff

WSO

E

[HIBUN]Extension log settings update

TLSUPDATE

E

[HIBUN]Hard disk expansion

ADDHDD

E

[HIBUN]Window active

ACT

H

[HIBUN]Start engine

EST

H

[HIBUN]Inactive or on standby

PWR

H

[HIBUN]Logoff and shutdown

END

H

[HIBUN]Start log acquisition

LST

H

[HIBUN]End engine

EEN

H

[HIBUN]Engine abnormality

OME

H

[HIBUN]Create file

FCR

H

[HIBUN]Copy file

FCP

H

[HIBUN]Move file

FMV

H

[HIBUN]Change file name

FRE

H

[HIBUN]Delete file

FDE

H

[HIBUN]Open file

FOP

H

[HIBUN]Overwrite and save file

FUD

H

[HIBUN]Add drive

ADD

H

[HIBUN]Delete drive

DED

H

[HIBUN]File compression

FCM

H

[HIBUN]Remote desktop connection

RDC

H

[HIBUN]File download

FDL

H

[HIBUN]File upload

FUP

H

[HIBUN]Web access

WAC

H

[HIBUN]Text copy

CPT

H

[HIBUN]Image copy

CPS

H

[HIBUN]Text paste

PST

H

[HIBUN]Image paste

PSS

H

Unknown

--

--

Legend: A: Access log, E: Event log, H: HIBUN extended operation log, --: Not applicable

#: It indicates the action for HIBUN version 10-50 and earlier versions.

(5) Configuring settings for HIBUN log import

If you import HIBUN logs, you need to modify the configuration file for the external log import command. By default, the command is configured not to import the HIBUN logs. For details about the configuration file for the external log import command, see ioutils importexlog (importing external logs) in the manual JP1/IT Desktop Management 2 Administration Guide.

Setting of the HIBUN logs that are not imported

You can specify HIBUN logs that are not imported at the time of HIBUN log import in the configuration file for the external log import command. By default, the following HIBUN logs are not imported:

Access log of an internal hard disk

File reference log

Network communication log (TCP/IP)

Importing unknown HIBUN logs

If you want to import unknown HIBUN logs that are not listed in the tables of What is displayed in Operation Type and What is displayed in Operation Type (Detail) described in (4) Viewing HIBUN logs imported into JP1/IT Desktop Management 2 into JP1/IT Desktop Management 2, you need to modify the configuration file for the external log import command. By default, the command is configured not to import the unknown HIBUN logs.

After the unknown HIBUN logs are imported into the operation log database, they are displayed as Unknown under Operation Type and Operation Type (Detail) in the Operation Log List view of the Security module. Then, action values in these unknown HIBUN logs are displayed in Target, separated by commas (,).

(6) Note on importing the HIBUN logs

The following is a note on importing the HIBUN logs:

If HIBUN logs are collected after the current time on a client computer is adjusted back, they are not imported into JP1/IT Desktop Management 2 because the system determines that the logs have already been imported.

In the setting view of operation logs, when you disable Automatically restore operation logs or reduce the value of Period for storing automatically restored operation logs, the operation logs that have been acquired to the database of operation logs are deleted. To acquire the HIBUN logs in the period on which the logs are deleted after restoring the setting, perform the acquisition after "Maintenance of the operation log database in which operation logs were automatically acquired" which is executed at 1:00 AM by default. You can specify the start time of "Maintenance of the operation log database in which operation logs were automatically acquired" on the configuration file.

If you have imported a HIBUN log in which the operation type is displayed as "Unknown" in a previous version of JP1/IT Desktop Management 2, the operation type will remain displayed as "Unknown" even if you upgrade to a new version of JP1/IT Desktop Management 2. The operation types that are supported by the upgrade will be displayed from the HIBUN log imported after the JP1/IT Desktop Management 2 upgrade.

2.11 Managing assets

You can use JP1/IT Desktop Management 2 to centrally manage information about assets, such as devices, software licenses, and contracts that are managed within an organization.

This will help you efficiently manage assets. You can list assets and manage them as though in a ledger. You can also define relationships between assets. By doing this, for example, you can quickly check the contracts that were made for devices or the usage status of software licenses.

There are two ways you can manage asset information: using Asset Console and using the operation window ofJP1/IT Desktop Management 2. For differences between the two methods and details on asset management using Asset Console, see the JP1/IT Desktop Management 2 - Asset Console Configuration and Administration Guide.

Note that these two methods cannot be used at the same time. To maintain consistency of the asset information, you need to select whether you will use Asset Console or not when setting up the JP1/IT Desktop Management 2 system.

Important

If the OS manages Chrome OS and ChromeOS Flex devices using Google Workspace as the MDM system, these devices are treated as "UNIX" by device type in the Asset Console.

This section describes how to manage assets using the operation window of JP1/IT Desktop Management 2.

You can use the operation window of JP1/IT Desktop Management 2 to centrally control asset information including devices, software licenses, and contracts that are managed in the organization. You can list assets and manage them as though in a ledger. You can also define relationships between assets. By doing this, for example, you can quickly check the contracts that were made for devices or the usage status of software licenses. This will help you efficiently manage assets. You can also manage devices that do not have IP addresses, such as displays and USB memory devices, in addition to devices with IP addresses. You can also add customer-specific information as extended information.

JP1/IT Desktop Management 2 supports the following asset management tasks:

Managing hardware assets

You can manage information about owned devices, such as computers, servers, printers, network devices, and USB devices, as hardware asset information. As well as being able to manage detailed information about hardware assets, you can check the status of hardware assets within an organization. You can manage the status, for example, by organizing hardware into categories, such as In Use, In Stock, or Disposed.

Managing software licenses

You can manage information about owned software licenses and the usage status of individual software licenses. You can not only manage the total number of licenses, but also check for computers that use licenses without permission (after licenses are assigned to individual computers).

Managing asset contracts

You can register information about contracts for hardware assets and software licenses (such as support contracts, rental contracts, or lease contracts), and manage the information about individual contracts associated with individual assets. You can check contracts for which the expiration date is approaching, which will help you schedule a work plan.

Managing costs for assets

By managing information about contracts regarding hardware assets and software licenses, you can check the costs for those assets. By utilizing this information, you can check for unnecessary costs or estimate the costs necessary for maintaining assets.

This section describes how to use JP1/IT Desktop Management 2 for those tasks. Refer to the description related to your target task.

2.11.1 List of the fields for asset information

The following tables list the fields for asset information. The following legend is used in the tables below:

Legend: --: Not supported.

Tip

You can add customized fields in addition to the fields shown below.

Tip

You can change the data source and type for some fields. For details, see (3) Types of asset fields that can be customized.

Hardware assets

Field

Description

Data source

Type

Asset #

Set the certificate number or use a unique number that is customized for easy management. This field is used as a mapping key when hardware asset information is imported.

System Administrator

Text

Device Name

Set a name for the asset.

System Administrator

Text

Description

Set information identifying the asset. We recommend that you enter information that will be easily identified when the information is displayed in a list.

System Administrator

Text

Files Attached

Register files related to the asset. If you register data such as the certificate of the hardware asset, you can reduce the time and effort when you want to view detailed information about the hardware asset.

System Administrator

--

Contract Vendor Name#4

Displays the contract vendor name in the associated contract information.

--

--

Contract Date#4

Displays the contract date in the associated contract information.

--

--

Asset Status

Set the status of the asset. You can set it as In Stock, In Use, or Disposed by default.

System Administrator

Enumeration

Planned Asset Status

Set the new asset status if you plan to change the asset status. You can set it as In Stock, In Use, or Disposed by default.

System Administrator

Enumeration

Planned Date

Set the date you plan to change the asset status (if you plan to change the asset status). If you set a date or report will be sent to notify you that operations are required for that asset when that date is approaching and on that date.

System Administrator

Date

Last Tracked Date

Set the date stocktaking of the asset was performed. You can also set that this management field is automatically updated.

System Administrator

Date

Department#1

Set the department that uses the asset.

The following data sources can be specified:

System Administrator

End User

Active Directory

Registry

The following data types can be specified:

Text

Enumeration

Hierarchy

Location#1

Set the location of the asset.

The following data sources can be specified:

System Administrator

End User

Active Directory

Registry

The following data types can be specified:

Text

Enumeration

Hierarchy

User Name#1

Set the name of the person who uses the asset. If the asset is used by more than one person, set the name of a representative.

The following data sources can be specified:

System Administrator

End User

Active Directory

Registry

Text

Account#1

Set information (for example, an employee number) that identifies the user (or a representative) of the asset.

The following data sources can be specified:

System Administrator

End User

Active Directory

Registry

Text

E-mail#1

Set the email address of the user (or a representative) of the asset.

The following data sources can be specified:

System Administrator

End User

Active Directory

Registry

Text

Phone#1

Set the phone number of the user (or a representative) of the asset.

The following data sources can be specified:

System Administrator

End User

Active Directory

Registry

Text

Registered Date/Time

Displays the date and time the asset information was registered.

--

--

Last Modified Date/Time

Displays the date and time the asset information was last modified.

--

--

Device Type#2

Set the device type. You can select PC, Server, Storage, Network Device, Printer, Smart Device, Peripheral Device, USB Device, Display, Other, or Unknown by default.

System Administrator

Enumeration

Model#2

Set the device model.

System Administrator

Text

Manufacturer#2

Set the manufacturer of the device.

System Administrator

Enumeration#3

Serial ##2

Set the serial number (BIOS information) of the device. This field is used as the mapping key when hardware asset information is imported or when the collected device information is automatically registered as hardware asset information.

System Administrator

Text

CPU#2

Set the CPU of the device.

System Administrator

Enumeration#3

Total Memory#2

Set the memory size of the device.

System Administrator

Text

Storage Capacity#2

Set the total capacity of the logical disks on the storage media (such as hard disks and SSDs) on the device.

System Administrator

Text

IP Address#2

Set the IP address of the device. If the device has multiple IP addresses, set a representative IP address for management. This field is used as a mapping key when hardware asset information is imported or when the collected device information is automatically registered as hardware asset information.

System Administrator

Text

Subnet Mask#2

Set the subnet mask of the device.

System Administrator

Text

MAC Address#2

Set the MAC address of the device. If the device has multiple MAC addresses, set a representative MAC address for management. This field is used as a mapping key when hardware asset information is imported or when the collected device information is automatically registered as hardware asset information.

System Administrator

Text

Host Name#2

Set the computer name or host name of the device. This field is used as a mapping key when hardware asset information is imported or when the collected device information is automatically registered as hardware asset information.

System Administrator

Text

OS#2

Set the OS installed on the device.

System Administrator

Enumeration#3

Device Instance ID

Displays the unique ID of a USB device only when Device Type is USB Device.

--

--

Free Storage Capacity

Set the total free capacity of the logical disks on the storage media (such as hard disks and SSDs) on the device.

System Administrator

Text

Display Type

Set the display type. You can select CRT, Liquid Crystal Display, Plasma Display, Video Projector, or Other.

System Administrator

Enumeration

Display Size

Set the display size.

System Administrator

Number

Display Graphic Mode

Set the resolution of the display from the following values:

VGA(640 by 480), SVGA(800 by 600), XGA(1024 by 768), WXGA(1280 by 800), SXGA(1280 by 1024), WSXGA+(1680 by 1050), UXGA(1600 by 1200), FHD(1920 by 1080), WUXGA(1920 by 1200), QXGA(2048 by 1536)or Other

System Administrator

Enumeration

UDID

Set the ID assigned to an Apple smart device.

System Administrator

Text

IMEI

Set the ID assigned to a mobile communication device. This field is used as a mapping key when hardware asset information is imported or when the collected device information is automatically registered as hardware asset information.

System Administrator

Text

IMSI

Set the ID assigned to the subscriber of a mobile communication device (the ID assigned to the SIM card of a smart device).

System Administrator

Text

ICCID

Set the ID assigned to the SIM card of an Apple smart device.

System Administrator

Text

Carrier

Set the carrier that provides communication service for a smart device.

System Administrator

Text

Contract phone number

Set the phone number of a contracted smart device. This field is used as a mapping key when hardware asset information is imported or when the collected device information is automatically registered as hardware asset information.

System Administrator

Text

Host ID

Displays the host ID value of imported hardware asset information. This field is used for identifying related devices being newly managed after hardware asset information has been imported. After device information and hardware asset information are associated with each other, the host ID becomes blank.

For details about identifying devices and hardware assets, see (2) Identifying related devices and hardware assets.

System Administrator

Text

#1: On an agent-installed computer, a value for this field can be entered from the End User Form view.

#2: When hardware asset information is associated with device information, if device information is modified, the corresponding hardware asset information is also modified. If '1' is set for the Asset_HardwareInfo_RestKind property in the configuration file (jdn_manager_config.conf), when the device type of the device to be updated is "Unknown", the hardware asset information will not be updated. For details about the Asset_HardwareInfo_RestKind property, see A.5 Lists of properties.

#3: Options are automatically generated based on the collected device information.

#4: This field appears only when the Contract Type is any of the following values, which can be used for new device purchase: Fixed, Rent, or Lease. For details, see the description on the procedure for purchasing devices in the JP1/IT Desktop Management 2 Administration Guide.

Software licenses

Field

Description

Data source

Type

License #

Set a number that uniquely identifies the software license. Use the software license certificate number, or use a unique number that is customized for easy management. This field is used as the mapping key when software license information is imported.

System Administrator

Text

License Name

Set a name for the software license that can be used for management in a list. We recommend that you use a name that clearly shows the contents of the license.

System Administrator

Text

License Type

Set the software license type.

System Administrator

Enumeration

Total Licenses

Set the total number of software licenses that you purchased.

System Administrator

Number

License Total

Displays the number of owned software licenses. For upgrade licenses and downgrade licenses, the number of licenses after upgrade or downgrade is automatically calculated.

--

--

Assigned License Total

Displays the number of licenses that have been assigned to computers.

--

--

Remaining License Total

Displays the number of software licenses resulting from the subtraction of Assigned License Total from License Total.

If the value becomes minus, a license violation might occur due to a software license shortage.

--

--

Upgrade Source Name

When you are entering asset information for an upgrade license, set the upgrade-source software license.

--

--

Description

Set information identifying the software license. We recommend that you enter information that will be easily identified when the information is displayed in a list.

System Administrator

Text

Files Attached

Register files related to the software license. If you register the certificate of the software license or other data as electronic data, you can reduce the time and effort when you want to view detailed information about the software license.

System Administrator

--

Contract Vendor Name

Displays the contract vendor name in the associated contract information.

--

--

Contract Date

Displays the contract date in the associated contract information.

--

--

License Status

Set the status of the software license. You can select In Use or Expired by default.

System Administrator

Enumeration

Planned License Status

Set the new status of the software license if you plan to change the status of the software license. You can select In Use or Expired by default.

System Administrator

Enumeration

Planned Date

Set the date you plan to change the status of the software license (if you plan to change the status of the software license). If you set a date, an event will be sent to notify you that operations are required for that software license when that date is approaching and on that date.

System Administrator

Date

Last Tracked Date

Set the date stocktaking of the software license was performed.

System Administrator

Date

Department

Sets the department that owns the software licenses. You have to set this item only when you want to manage software licenses by department.

System Administrator

The following data types can be specified:

Text

Enumeration

Hierarchy

Managed Software Name

Set the name of the software that corresponds to the software license.

System Administrator

--

Manufacturer

Displays the manufacturer of the managed software associated with the contract.

--

--

Registered Date/Time

Displays the date and time the software license information was registered.

--

--

Last Modified Date/Time

Displays the date and time the software license information was last modified.

--

--

Managed software

Field

Description

Data source

Type

Managed Software Name

Set a name used to manage the software program. For example, when different versions of software programs Software HOGE 1.0 and Software HOGE 2.0 are specified in Installed Software, if you register the name Software HOGE in this field, those software programs can be managed as one type of software program. This field is used as a mapping key when managed software information is imported.

System Administrator

Text and Enumeration#

Description

Set information identifying the software program. We recommend that you describe the software program or enter the relationship with the installed software information.

System Administrator

Text

License Type

Displays the license type in the associated software license information.

--

--

License Total

Displays the number of licenses in the associated software license information.

--

--

Number of Used Licenses

Displays the total number of devices on which the managed software program has been installed.

When the OS type is not All, the devices with the specified OS type are counted toward the number of used licenses.

--

--

Remaining License Total

Displays the number of software licenses resulting from the subtraction of Number of Used Licenses from License Total.

If the value becomes minus, a license violation might occur due to a software license shortage.

--

--

Assigned License Total

Displays the number of licenses that have been assigned to computers.

If Number of Used Licenses is greater than Assigned License Total, users might have installed software programs without notice.

--

--

Software Vendor

Set the manufacturer of the software program.

System Administrator

Text and Enumeration#

OS Type

Set the type of operating system running on the device on which the software program is installed. When the OS type is All, devices are managed regardless of the type of operating system.

System Administrator

Enumeration

Registered Date/Time

Displays the date and time the managed software information was registered.

--

--

Last Modified Date/Time

Displays the date and time the managed software information was last modified.

--

--

#: Options are automatically generated based on the collected software information.

Contracts

Field

Description

Data source

Type

Contract #

Set the contract number or a unique number that is customized for easy management. This field is used as a mapping key when contract information is imported.

System Administrator

Text

Contract Name

Set the name used to manage the contract. We recommend that you use a name that clearly shows the contents of the contract.

System Administrator

Text

Contract Type

Set the contract type. You can select Fixed, Lease, Rent, Maintenance, or Support by default.

System Administrator

Enumeration

Contract Term

Set the period of time of the contract. As the expiration date approaches, email notification will be regularly sent to the administrator.

System Administrator

Date

Description

Set information for identifying the contract. We recommend that you enter information that will be easily identified when the information is displayed in a list.

System Administrator

Text

Files Attached

Register files related to the contract. If you register data such as the certificate of the contract, viewing detailed information about the contract is quicker and easier.

System Administrator

--

Contract Vendor Name

Set information about the contract vendor. Contact information enables you to easily contact the vendor when you renew the contract, ask for a quotation, or ask for troubleshooting.

System Administrator

Enumeration

Contract Date

Set the date the contract was made. Register the contract date written in the contract document.

System Administrator

Date

Payment Mode

Set how to pay the costs specified in the contract.

System Administrator

Enumeration

Monthly Cost ($)

Set the monthly cost of the contract.

System Administrator

Number

Total Cost ($)

Set the total cost of the contract.

System Administrator

Number

Contract Status

Set the status of the contract. You can select from Active, Canceled, or Expired by default. If the value for this field has not changed to Expired or Canceled even after the expiration date for the contract passed, the contract is treated as expired.

System Administrator

Enumeration

Department

Sets the department that owns the assets associated with the contract. You have to set this item only when you want to manage contracts by department.

System Administrator

The following data types can be specified:

Text

Enumeration

Hierarchy

Registered Date/Time

Displays the date and time the contract information was registered.

--

--

Last Modified Date/Time

Displays the date and time the contract information was last modified.

--

--

Related Topics:

2.11.7 Importing asset information

(2) Data sources for asset fields

(1) Data types for asset fields

(1) Data types for asset fields

For asset fields, the data types below are used. The following legend is used in the tables below:

Legend: Y: Can be input. N: Cannot be input.

Number

This data type is used to input only a number (-2,147,483,647 to 2,147,483,647). If you want to manage a numerical value related to an asset, select this data type. Note that space characters input at the end are ignored.

Date

This data type is used to input a date. If you want to manage a date related to an asset, select this data type.

Enumeration

This data type is used to select a value from options. If you select this data type, you need to create the options. Each option can be a character string with 256 or less characters. If you want to manage information for which the input values must be restricted, select this data type.

Text

This data type is used to specify a character string with 256 or less characters. If you want to manage information for which any input value is allowed, select this data type. You can also restrict the characters that can be input. Note that space characters entered at the end are ignored.

Hierarchy

This data type can be used only for Department and Location under Common Fields (Assets and Device Inventory). You can set hierarchical options for up to 40 hierarchies. For each option, you can specify a character string with 256 or less characters excluding slashes (/). The hierarchical structure edited here will be also used in the menu area in the Assets and Inventory modules.

Note that when you specify a hierarchical option, the total path to the option (including the path of the upper options) must be specified with 512 or less characters. In this case, a delimiter (which is counted as one character) must be placed at the beginning of the path, at the end of the path, and between options respectively. For example, if you create options in three hierarchies as Tokyo - Sales - Section1, the number of characters for the path is 22 (/Tokyo/Sales/Section1/).

Tip

For Department and Location, you can also enter hierarchical information in Enumeration or Text type. In this case, delimit options by using a slash (/): for example, /HeadOffice/Development/Section2/. You can omit slashes at the beginning and at the end of the character string. This character string (hierarchical information) must have 512 or less characters. When you omit the slashes at the beginning and at the end of the character string, the character string must have 510 or less characters.

Restrictions on characters that can be set for Text type data

The table below describes the types of restrictions on characters that can be set for Text type data. You can also set customized restrictions other than the restrictions shown below.

General restrictions on characters

Characters

Restrictions on characters

Every characters

Alphabetic only

Alphanumeric only

Single-byte characters

Double-byte alphabetic only

Double-byte alphanumeric only

Double-byte numbers only

Alphabetic (uppercase)

Y

Y

Y

Y

N

N

N

Alphabetic (lowercase)

Y

Y

Y

Y

N

N

N

Numbers

Y

N

Y

Y

N

N

N

Periods

Y

N

N

Y

N

N

N

Hyphens

Y

N

N

Y

N

N

N

Plus signs

Y

N

N

Y

N

N

N

At marks

Y

N

N

Y

N

N

N

Blanks

Y

N

N

Y

N

N

N

Other signs

Y

N

N

Y

N

N

N

Single-byte kana characters

Y

N

N

Y

N

N

N

Double-byte alphabetic (uppercase)

Y

N

N

N

Y

Y

N

Double-byte alphabetic (lowercase)

Y

N

N

N

Y

Y

N

Double-byte numbers

Y

N

N

N

N

Y

Y

Double-byte spaces

Y

N

N

N

N

N

N

Characters other than alphanumeric

Y

N

N

N

N

N

N

Restrictions on characters for people's names

Characters

Restrictions on characters

Name 1

Name 2 (using double-byte characters, delimited by a double-byte space)

Name 3 (using double-byte characters, without spaces)

Alphabetic (uppercase)

Y

N

N

Alphabetic (lowercase)

Y

N

N

Numbers

Y

N

N

Periods

Y

N

N

Hyphens

Y

N

N

Plus signs

Y

N

N

At marks

Y

N

N

Blanks

Y

N

N

Other signs

Y

N

N

Single-byte kana characters

Y

N

N

Double-byte alphabetic (uppercase)

N

Y

Y

Double-byte alphabetic (lowercase)

N

Y

Y

Double-byte numbers

N

Y

Y

Double-byte spaces

N

Y

N

Characters other than alphanumeric

Y

Y

Y

Restrictions on characters for phone numbers and email addresses

Characters

Restrictions on characters

Phone number 1 (delimited by a hyphen)

Phone number 2 (for international telephone, delimited by a hyphen)

Phone number 3 (without hyphens)

Email address

Alphabetic (uppercase)

N

N

N

Y

Alphabetic (lowercase)

N

N

N

Y

Numbers

Y

Y

Y

Y

Periods

N

N

N

Y

Hyphens

Y

Y

N

Y

Plus signs

N

Y

N

Y

At marks

N

N

N

Y

Spaces

N

N

N

N

Other signs

N

N

N

Y

Single-byte kana characters

N

N

N

N

Double-byte alphabetic (uppercase)

N

N

N

N

Double-byte alphabetic (lowercase)

N

N

N

N

Double-byte numbers

N

N

N

N

Double-byte blanks

N

N

N

N

Characters other than alphanumeric

N

N

N

N

Related Topics:

2.11.1 List of the fields for asset information

(3) Types of asset fields that can be customized

(2) Data sources for asset fields

For asset fields that can be customized, you can set the following four data sources:

System Administrator

The system administrator directly enters information in the operation window, or inputs information by importing a CSV file.

End User

Displays the End User Form view on agent-installed computers, and acquires information input by users.

Users need to perform some operations, but this can reduce the workload for the administrator by removing the need to investigate user-specific information and input the information. When this method is used, departments and locations are grouped depending on the acquired information, so you can automate grouping tasks.

Active Directory

When JP1/IT Desktop Management 2 is linking with Active Directory, information managed as computer properties by Active Directory is acquired.

You can utilize the information managed by Active Directory to manage devices and assets.

Registry

Information about the specified registry items is collected. You can manage information that depends on the user environments.

Important

Only information of Text data type can be acquired from Active Directory.

Related Topics:

(3) Types of asset fields that can be customized

(3) Types of asset fields that can be customized

The following describes the types of asset fields, data types, and data sources that can be set in the Asset Field Definitions view (under Assets) of the Settings module.

Types of asset fields

Common Fields (Assets and Device Inventory)

Sets the fields common to the hardware asset information in the Assets module and the device inventory in the Inventory module. The asset fields under Common Fields (Assets and Device Inventory) have already been set by the system. So, you cannot add or delete them.

Custom Fields (Hardware Assets)

Sets the fields in the hardware asset information in the Assets module. You cannot delete the following asset fields:

Asset Status and Device Type that have already been set by the system

An asset field that is specified as a condition for automatically maintaining host groups and IDs managed by Remote Install Manager

If a custom field value is set as the following conditions, the value cannot be edited or deleted,

Filter condition

Automatic maintenance condition for host groups and IDs

For single server configuration, the display order of each item is based on creation order. For multi-server configuration, the display order of each item is based on the UTF-8 character code order.

Custom Fields (Software License)

Sets the fields in the software license information in the Assets module. License Status and License Type have already been set by the system. So, you cannot delete them.

The display order of each item is based on creation order.

Custom Fields (Contracts)

Sets the fields in the contract information in the Assets module. Contract Status and Contract Type have already been set by the system. So, you cannot delete them.

The display order of each item is based on creation order.

Editable fields differ depending on the asset field. The following table describes the editable fields.

Asset field

Field name

Data source

Description

Data type

Common Fields (Assets and Device Inventory)#

Department

N

Y

Y

Y

Location

N

Y

Y

Y

User Name

N

Y

Y

*1

Account

N

Y

Y

*1

E-mail

N

Y

Y

*1

Phone

N

Y

Y

*1

System-specific asset fields#

Asset Status

N

N

N

*2

Device Type

N

N

N

*2

License Status

N

N

N

*2

License Type

N

N

N

*2

Contract Status

N

N

N

*2

Contract Type

N

N

N

*2

Custom asset fields

Y

*3

Y

Y

Legend:

Y: Can be edited.

*1: The data type is fixed to the Text type, but characters that can be input can be edited.

*2: The data type is fixed to the Enumeration type, but options can be added.

*3: For the custom fields in software license information and contract information, the data source is fixed to System Administrator.

N: Cannot be edited.

#: These fields have already been set by the system, so you cannot delete them.

Tip

The settings of the Asset Field Definitions view in the Settings module are applied to agents at the timing set in the Perform polling based on the system item in the Basic Settings view for the agent configuration. A balloon tip is displayed to prompt the user to enter user information.

Tip

If Department or Location is set to be entered by users directly under Common Fields (Assets and Device Inventory) in the Asset Field Definitions view (under Assets) of the Settings module, a balloon tip will be displayed prompting users to input user information when you update or delete a group corresponding to Department or Location items in the menu area.

Related Topics:

2.11.1 List of the fields for asset information

(1) Data types for asset fields

(2) Data sources for asset fields

2.11.2 Managing hardware asset information

In the Hardware Assets view of the Assets module, you can register and manage hardware asset information.

When devices are set to be managed, information collected from those devices is displayed in the Device Inventory view of the Inventory module. Information about those devices is also registered automatically as new hardware asset information in the Hardware Asset view of the Assets module. The following figure shows the flow when hardware asset information is registered.

For hardware asset information that was automatically registered, Asset Status becomes Unconfirmed, and only the information items collected from devices are registered. Therefore, information items that are not automatically collected from devices, such as Asset #, Asset Status (for example, In Use or In Stock), and user information, must be registered in hardware asset information later.

When device inventory is updated, the information items (collected from devices) in hardware asset information is also updated. If '1' is set for the Asset_HardwareInfo_RestKind property in the configuration file (jdn_manager_config.conf), when the device type of the device to be updated is "Unknown", the hardware asset information will not be updated. For details about the Asset_HardwareInfo_RestKind property, see A.5 Lists of properties.

If hardware assets have already been managed on a management ledger, you can import the information to JP1/IT Desktop Management 2. If no management ledger has been used, maintain the automatically registered hardware asset information.

If you want to manage hardware asset information about devices other than the managed devices, newly register hardware asset information for those devices.

Note that you need to maintain hardware asset information depending on the operation.

You can manage hardware asset information by associating it with other types of hardware information, or by setting the corresponding contract information.

Tip

You can also use the ioutils importassetassoc command to associate hardware asset information with device information, other hardware asset information, and contract information.

Tip

If multiple devices are associated with a hardware asset, specify one of the devices as the primary inventory. The hardware information acquired from the primary inventory is displayed in the Hardware Assets view of the Assets module as hardware asset information.

Tip

If the device specified as the primary inventory is removed or associated with other hardware asset information, the primary inventory changes as follows:

When the device specified as the primary inventory is removed, another device associated with the hardware asset becomes the primary inventory.

If the association is changed so that the device specified as the primary inventory is associated with another hardware asset, another device already associated with the hardware asset is used as the primary inventory.

In each case, if two or more devices are associated as well as the device that is to be removed or whose association is to be changed, the device having the latest update date and time becomes the primary inventory. This also applies when duplicate devices and idle devices are automatically removed by auto maintenance of devices.

Related Topics:

(6) Managing hardware asset information associated with other information

2.11.1 List of the fields for asset information

(1) Associating devices and hardware assets

In hardware asset management, device information and hardware asset information are associated with each other. If a device is set to be managed, hardware asset information is automatically registered and associated with the device information. However, if a device is not set to be managed, or if hardware asset information only is registered, the device information and hardware asset information might not be associated.

The following table describes the details about association of devices and hardware assets corresponding to each trigger.

Trigger

Description

An agent-installed device connects to the management server.

Device information of the target device is registered, and hardware asset information is automatically registered at the same time. The hardware asset information is associated with the device information.

A device is discovered during device search (when the settings are configured so that a discovered computer is automatically set as a managed device).

Device information of the target device is registered, and hardware asset information is automatically registered at the same time. The hardware asset information is associated with the device information.

Note that if Device Type is other than PC, device information and hardware asset information are not registered because the device is not automatically set as a managed device. Therefore, association of device information and hardware asset information is not performed.

A device is discovered during device search (when the settings are configured so that a discovered computer is not automatically set as a managed device).

Device information and hardware asset information are not registered.

Hardware assets are imported using a CSV file.

Hardware asset information is registered, but device information is not registered. Therefore, association of device information and hardware information is not performed. However, if device information and hardware asset information have already been associated, the imported hardware asset information remains associated with device information.

A USB device is registered.

Hardware asset information is registered for a device for which Device Type is USB Device, but device information is not registered. Therefore, association of device information and hardware information is not performed.

A hardware asset is manually added in the Assets module.

Hardware asset information is registered, but device information is not registered. Therefore, association of device information and hardware asset information is not performed. However, if device information and hardware asset information have already been associated, the imported hardware asset information remains associated with device information.

When a device and a hardware asset have been associated, the association might be released if the status of device information or hardware asset information is changed or information is deleted.

The following table describes how association changes for each trigger when a device and a hardware asset have been associated.

Trigger

Description

Asset Status of a hardware asset is changed to Disposed.

Device Inventory in hardware asset information is deleted, and association is released. Also, the target device is deleted from the device list in the Inventory module.

Note that if an agent has been installed on the target device, the device will become a managed device again when the next device search is performed. In this case, if Asset Status is set to Disposed in hardware asset information, the same hardware asset information will be registered doubly. Therefore, when you set Asset Status to Disposed, we recommend that you disconnect the target device from the network or uninstall the agent. If Asset Status is set to other than Disposed in hardware asset information, the association will be registered again.

A target device is deleted in the Managed Nodes view of the Settings module.

Device Inventory in hardware asset information is deleted, and association is released. Also, the target device is deleted from the device list in the Inventory module.

The behavior when an agent-installed device becomes a managed device again is the same as the behavior when Asset Status is set to Disposed in hardware asset information.

If the device specified as the primary inventory is deleted, the other device associated with the corresponding hardware asset is set as the primary inventory. (If more than one device is associated with the hardware asset, the last-updated device becomes the primary inventory.)

A target device is set to Ignored in the Managed Nodes view of the Settings module.

The target device is deleted from the device list in the Inventory module. Device Inventory in hardware asset information is not deleted.

Note that when an agent has been installed on the target device, if you manually set the device to be managed again, the target device is registered again in the device list.

A hardware asset is deleted.

Hardware assets can be deleted only when Asset Status is Unconfirmed or Disposed. The following are behaviors of the device when a hardware asset is deleted:

When Asset Status is Unconfirmed:

The target device is deleted from the Device Inventory view of the Inventory module.

When Asset Status is Disposed:

The target device has already been deleted from the Device Inventory view of the Inventory module.

When deleting Hardware Asset with Disposed as Asset Status, the system configuration information is not deleted in association with deletion of hardware asset.

(2) Identifying related devices and hardware assets

When a device is set to be a managed device, hardware asset information is automatically registered and associated with device information. If hardware asset information corresponding to the managed device has already been registered, related registered device information is identified. If device information and hardware asset information that are related with each other are identified, they will be associated. If the identified hardware asset information is already associated with other device information, the primary inventory assigned to the hardware asset information remains unchanged.

For identification of related device information and hardware asset information, one of the items in the following table is used.

Priority

Item compared during identification

1

Host ID#1

2

IMEI#2

3

Serial number #3

4

Host Name

5

MAC Address

6

Contract phone number#2

7

IP Address

#1: If a value of the host ID is written in the CSV file that is imported as the asset information, after the device information and the hardware asset information are identified, the host ID becomes blank to prevent it from being used to identify other devices.

#2: Used when managing a smart device by linking with an MDM system.

#3: Serial number of BIOS information. For UNIX and Mac agents, the serial number will be "blank" and will not be used for identification.

During identification, the values of the higher priority items are compared first. If the values for an item with a higher priority have not been acquired or are invalid, the values for the item with the next higher priority are compared.

If the values for an item match, a relationship between device information and hardware asset information is identified, and device information related to the hardware asset information is added. If the values for the items do not match, new hardware asset information is registered.

Important

When only device information has been registered, even if corresponding hardware asset information is registered later, the relationship between device information and hardware asset information is not identified. In that case, manually associate them.

Tip

You can use the ioutils importasset command to set the association between hardware asset information and devices.

(3) Collecting information entered by users

If agents have been installed on managed computers, you can display the End User Form view on users' computers, and have hardware asset information automatically updated by information entered by users.

By collecting information entered by users, the system administrator can reduce the time and effort for maintaining hardware asset information. For example, if users enter the latest information regularly, even after a large number of people move to different departments, the system administrator can understand user information without any need for special activities to gain the information.

Important

When shared VDI-based virtual computers are designated as management targets, information entered by users cannot be collected.

The following fields can be entered by users:

Department

Location

User Name

Account

E-mail

Phone

Custom fields that are optionally added

To collect user information, you need to set (in advance) asset fields to be entered by users in the Asset Field Definitions view (under Assets) of the Settings module. To display the End User Form view, the display of the user input window must be specified in the User notification settings view for the agent configuration.

In the Asset Field Definitions (under Assets) of the Settings module, the system administrator can also specify the time to allow users to start entering information. The End User Form view can be displayed after the settings of multiple fields have changed. So, this view is useful for updating information in accordance with personnel changes at the beginning of a fiscal year.

Important

If an agent whose version is JP1/IT Desktop Management 10-01 or earlier or Job Management Partner 1/IT Desktop Management 10-01 or earlier is installed on users' computers, even if the entry start date and time is specified, the End User Form view appears each time a field setting changes. To specify the entry start date and time, install an agent whose version is JP1/IT Desktop Management 10-02 or later or Job Management Partner 1/IT Desktop Management 10-10 or later on the users' computers.

The End User Form view can be displayed on a regular basis on users' computers that are managed online. To do so, specify the display of the user input window in the User notification settings view for the agent configuration. At this time, do not specify the entry start date and time in the Asset Field Definitions view of the Settings module. If you specify the entry start date and time, the End User Form view will not be displayed on a regular basis. For offline-managed computers, the End User Form view can be displayed when the getinv.vbs command or setsecpolicy.vbs command is executed to collect device information.

Before the specified entry start time is reached, selecting Windows Start, All Programs, JP1_IT Desktop Management 2 - Agent, and then End User Form on the user's computer only causes a message to appear. At this time, user information cannot be entered. The End User Form view is not displayed on offline-managed computers when the getinv.vbs command or setsecpolicy.vbs command is executed.

(4) Managing the asset status

In hardware asset information, you can set the asset status, which indicates whether the asset is in use, in stock, or in other statuses. By setting the asset status, you will be able to check the usage status of assets, as well as check a list of owned assets. You can also check disposed assets, as well as owned assets.

There are following asset statuses:

Unconfirmed

Asset information has been registered, but it is not managed as an asset. This asset status is set for the hardware asset information automatically registered when a device is set to be managed. If there is an asset whose status is Unconfirmed, check the actual hardware and set the asset information including the asset status.

In Stock

The asset is not used.

In Use

The asset is in use.

Disposed

The asset has been disposed of.

The administrator can add custom asset statuses other than above (no more than 100 items excluding the default asset statuses).

The following figure shows the transition of asset statuses.

To check the usage status, change the asset status according to actual operations.

When a new asset is registered, it is registered as Unconfirmed. Confirm the asset and then, based on the actual status, change its status to In Use, In Stock, or a custom asset status. Note that, when the status is Unconfirmed, the asset is not registered as an asset and an association cannot be made. To make an association, you will need to change the status to a status other than Unconfirmed.

After you change the status of an asset to Disposed (for example, because the asset that no longer needs to be managed), you can still change the status back to In Use, In Stock, or a custom asset status.

Managing the planned asset status

You can set asset statuses that are planned to change in the future. By setting planned asset statuses, you can check the planned tasks for asset management.

For example, for an asset with In Stock status, if you set the planned asset status to Disposed and set a date for that plan, you can check the date planned for disposal of the asset.

The specifiable types of the planned asset status are the same as for asset status.

Important

Note that planned asset status is not automatically changed when the planned date expires. The administrator must manually change the asset status around the planned date after making sure that the status of the actual hardware asset has changed. If you change the asset status to the one set for the planned asset status, the values set for the planned asset status and the planned date are cleared.

Tip

If you register a planned asset status, the relevant asset can be checked on a summary report. In addition, after the aggregation of a daily, weekly, or monthly summary report finishes, an email notification is sent to the recipients specified in the report's email settings.

(5) Updating the tracked date

You can update Tracked Date for hardware asset information and software license information. By updating Tracked Date, you can check whether all assets have been tracked.

Updating the tracked date manually:

Select information about an asset for which Tracked Date is to be updated, and then update Tracked Date. We recommend that you use this method to individually track a small number of assets around you.

Updating the tracked dates in a batch based on a CSV file:

Use a CSV file containing Asset # or License # information to update Tracked Date in a batch. Tracked Date for the individual assets will become the same. We recommend that you use this method to track assets by using a bar code reader. Output a list of Asset # or License # read by a bar code reader to a CSV file.

Setting automatic update of the tracked date:

You can set the tracked date in hardware asset information to be automatically updated. JP1/IT Desktop Management 2 checks the existence of devices by monitoring network connection of devices, users' input on devices, and notification of device information acquired from computers managed offline. If the devices are confirmed to exist, the tracked date is automatically updated. We recommend that you use this method to reduce the time and effort of tracking assets.

Important

Even if Update Tracked Date (on receiving End User Form) is selected in the Update Tracked Date (Automatically) dialog box, the tracked date in hardware asset information is updated automatically if Update Device Details is selected from the Action menu. This menu appears in the Device List view (under Device Inventory) of the Inventory module.

Tip

You can also import hardware asset information and software license information, and then update Tracked Date in a batch. In this case, you can set different dates for Tracked Date for individual assets.

(6) Managing hardware asset information associated with other information

You can manage information about a hardware asset by associating it with other hardware assets, or you can set the contract information corresponding to a hardware asset.

By associating information about a hardware asset with other hardware assets, you can manage a computer, display, and peripheral devices as a set.

By setting the contract corresponding to a hardware asset, you will be able to check the contract that was made for a computer. Also, you will be able to use a report to check the operational costs necessary for a hardware asset.

2.11.3 Checking the usage status of software licenses

Before starting software license management, you need to register managed software information and software license information in JP1/IT Desktop Management 2. Registering such information will enable you to check the usage status of software licenses. The following figure shows an overview of viewing the number of software licenses to check whether there is an excess or shortage of software licenses.

For software license information, set information about the owned software licenses and the corresponding software names (managed software names). For software license information, you can also register the computers to which the software licenses are assigned (that is, use of the software is allowed). Use the Software Licenses view of the Asset module to set software license information.

For managed software information, specify information about the software programs for which the number of used licenses is to be counted. You can also specify information about multiple software programs as one type of software programs. This will count the number of installed software programs for each managed software program. Use the Managed Software view of the Asset module to specify the managed software information.

When software license information and managed software information are registered, you can collectively check the usage status of software licenses for each managed software program in the Software License Status view of the Asset module. For example, checking the number of computers with software licenses assigned (number of assigned licenses) allows you to find the computers on which software has been installed without permission. You can also find the computers for which the use of software is allowed but no software is installed. In addition, the total number of owned licenses and the number of remaining licenses are counted for each managed software program. So, you can check whether there is an excess or shortage of software licenses. The usage status of software licenses can be output to a CSV file by exporting the software license status list in the Software License Status view.

The license fee or license type of a software program can vary depending on which operating system the software program is installed on. The number of used licenses of such a software program can be counted for each operating system type. The OS type is registered in managed software information.

The Software License Status view allows you to check the usage status of software licenses by department. The following provides examples of managed software names, values specified in software license information, and usage status of software licenses, and shows the values displayed in the Software License Status view as an example of specifications.

Specification examples of managed software names and software license information, and usage status of software licenses

Managed software name

Software license information

Usage of software licenses

Department

Total number of owned licenses

Number of assigned licenses

Number of installed programs

Department to which the computer with programs installed belongs

ABC software

General affairs department

10

10

12

General affairs department

Sales department

10

10

10

Sales department

Development department

5

10

5

Development department

Development department/Division A

5

10

3

Development department/Division A

Development department/Division B

5

3

3

Development department/Division B

--

--

--

3

Development department/Division C

--

--

--

1

Personnel department

XYZ software

--

20

2

1

Development department/Division A

1

Development department/Division B

Legend: --: Not specified

Information displayed in the Software License Status view

Managed Software Name

Department

License Total

Number of Used Licenses

Remaining License Total

Assigned License Total

Description

ABC software

(Total of All Departments)#1

35

37

-2

43

The total values of all departments (General affairs, Sales, Development, and Personnel departments) are displayed.

General affairs department

10

12

-2

10

The values only for the General affairs department are displayed.

Sales department

10

10

0

10

The values only for the Sales department are displayed.

Development department#2

15

14

1

23

The values only for the Development department (total values of Development department, Development department/Division A, Development department/Division B, and Development department/Division C) are displayed.

Development department/Division A#2

5

3

2

10

The values only for Development department/Division A are displayed.

Development department/Division B#2

5

3

2

3

The values only for Development department/Division B are displayed.

Development department/Division C#2

--

3

--

0

The values only for Development department/Division C are displayed.

If an upper-level department (Development department) is set for department information in software license information but a local department (Development department/Division C) is not set, a hyphen (-) appears for License Total and Remaining License Total.

Personnel department

0

1

-1

0

The values only for the Personnel department are displayed.

If neither a local department (Personnel department) nor an upper-level department is set for department information in software license information, 0 appears for License Total and Assigned License Total. A negative value appears for Remaining License Total.

XYZ software

(Total of All Departments)#1

20

2

18

2

The total values of all departments (General affairs, Sales, Development, and Personnel departments) are displayed.

The values of License Total and Assigned License Total for the software programs for which a department is not specified in software license information are also added.

Development department#2

--

2

--

2

The values only for the Development department (total values of Development department, Development department/Division A, and Development department/Division B) are displayed.

If a department is not set for software license information, a hyphen (-) appears for License Total and Remaining License Total.

Development department/Division A#2

--

1

--

1

The values only for Development department/Division A are displayed.

If a department is not set for software license information, a hyphen (-) appears for License Total and Remaining License Total.

Development department/Division B#2

--

1

--

1

The values only for Development department/Division B are displayed.

If a department is not set for software license information, a hyphen (-) appears for License Total and Remaining License Total.

Legend: --: Not applicable

Note: Clicking Software License Status List in the menu area displays all fields in the table.

#1: This field is displayed if (Total of All Departments) is clicked in the menu area.

#2: This field is displayed if Development Department is clicked in the menu area.

Important

From JP1/IT Desktop Management 09-51 and Job Management Partner 1/IT Desktop Management 10-01, the way of counting the number of used licenses has changed. Therefore, if you upgrade the version, the number of used licenses might be different.

For the number of used licenses, the number of installed software programs corresponding to the managed software programs is displayed. In JP1/IT Desktop Management 09-51 and Job Management Partner 1/IT Desktop Management 10-01, if multiple software programs corresponding to a managed software program have been installed on a computer, all of those software programs are counted for licenses. In JP1/IT Desktop Management 09-51 or later and Job Management Partner 1/IT Desktop Management 10-01 or later, if multiple software programs corresponding to a managed software product have been installed on a computer, they are counted so that only one license is consumed.

For Windows Store apps, the number of licenses actually purchased sometimes differs from the number of licenses detected by JP1/IT Desktop Management 2. This is because, while JP1/IT Desktop Management 2 detects the number of devices on which the applicable software is installed as the number of licenses, licenses for Windows Store apps are assigned to each account, not to each device.

(1) Managing managed software information

In the Managed Software view of the Assets module, you can register and manage managed software information.

You can register managed software information manually or by importing a CSV file created for managed software information.

If the corresponding software programs are added or changed, maintain managed software information to keep the latest status.

Note that you can update managed software information in a batch by exporting it and then importing an edited CSV file. You can also delete managed software information for which management is no longer needed.

When managed software information is registered, you can check the usage status of software licenses for each managed software in the Software License Status view of the Asset module.

(2) Managing license status

In software license information, you can set License Status, which indicates whether the license is in use, expired, or in other statuses. By setting License Status, you will be able to check the expired software licenses, as well as a list of owned licenses.

There are following types of license statuses:

In Use

The software license is in use.

Expired

The software license has expired.

The administrator can add other custom license statuses (no more than 100 license statuses excluding the default license statuses).

Managing planned license statuses

You can set license statuses that are planned to change in the future. Setting planned license statuses will enable you to check planned license management tasks. The specifiable fields for planned license status are the same as for license status.

For example, for a software license with In Use status, if you set the planned license status to Expired and set the planned date, you will be able to check the date the software license will expire.

The planned license status types are the same as those of license status.

Note that the planned license status is not automatically changed when the planned date expires. The administrator must manually change the license status around the planned date. If you change the license status to the one set for the planned license status, the values set for the planned license status and the planned date are cleared.

(3) Managing software license information

In the Software License view of the Assets module, you can register and manage information about the total number of owned licenses, corresponding contract information, departments, and other information.

You can use the software type as a judgment condition when considering whether to manage software licenses. For example, you can choose to manage only the licenses for commercial-type software. The software type is displayed in the Installed Software tab of the Managed Software view under the Assets module or the Software Inventory view of the Inventory module, when software dictionary information is updated offline.

For software licenses that are determined to be managed, maintain software license information to keep the status current. For example, you should maintain information about changes to the software to which the licenses are assigned, disposal of software, and addition or deletion of relevant contracts.

You can register software license information manually or by importing a CSV file that was created by editing exported software license information.

You can also delete software license information for which management is no longer needed.

Related Topics:

(5) Managing assignment of software licenses

(4) Updating the tracked date

You can update Tracked Date for hardware asset information and software license information. By updating Tracked Date, you can check whether all assets have been tracked.

Updating the tracked date manually:

Select information about an asset for which Tracked Date is to be updated, and then update Tracked Date. We recommend that you use this method to individually track a small number of assets around you.

Updating the tracked dates in a batch based on a CSV file:

Use a CSV file containing Asset # or License # information to update Tracked Date in a batch. Tracked Date for the individual assets will become the same. We recommend that you use this method to track assets by using a bar code reader. Output a list of Asset # or License # read by a bar code reader to a CSV file.

Setting automatic update of the tracked date:

You can set the tracked date in hardware asset information to be automatically updated. JP1/IT Desktop Management 2 checks the existence of devices by monitoring network connection of devices, users' input on devices, and notification of device information acquired from computers managed offline. If the devices are confirmed to exist, the tracked date is automatically updated. We recommend that you use this method to reduce the time and effort of tracking assets.

Important

Even if Update Tracked Date (on receiving End User Form) is selected in the Update Tracked Date (Automatically) dialog box, the tracked date in hardware asset information is updated automatically if Update Device Details is selected from the Action menu. This menu appears in the Device List view (under Device Inventory) of the Inventory module.

Tip

You can also import hardware asset information and software license information, and then update Tracked Date in a batch. In this case, you can set different dates for Tracked Date for individual assets.

(5) Managing assignment of software licenses

If you manage computers by assigning software licenses to them, you will be able to check for computers on which software has been installed without permission. You will also be able to check for software licenses that are not used even though their use is permitted.

To realize this, in software license information, specify the computers to which software licenses are to be assigned. Then, when you register managed software information, associate the software license information with it. As a result, information about computers on which software programs have been installed and information about computers to which software licenses are assigned can be compared. This will enable you to confirm whether software licenses are being used as assigned. The following figure shows how software licenses are assigned and managed.

You can check whether software is used as assigned on the Installed Computers and Licensed Computers tabs in the Managed Software view of the Assets module.

The Installed Computers tab displays the computers on which software programs specified in managed software information have been installed. If you select the Show Only Computers Not Licensed check box on this page to display the computers to which software licenses have not been assigned, you can check for computers on which software programs have been installed without permission.

The Licensed Computers tab displays the computers to which software licenses have been assigned. To check for unused software licenses, select the Show Only Computers Not Installed check box. This will display the computers that software licenses have been assigned to but the software has not been installed on.

Tip

You can also use the ioutils importassetassoc command to assign software licenses to computers.

(6) Managing software license information and the associated contract information

For software license information, you can set the corresponding contract information.

Setting contracts corresponding to the software licenses will enable you to check which contract was made for a software license. Also, you will be able to check the operational costs for software licenses using reports.

Multiple software licenses can be associated with one contract.

Tip

You can also use the ioutils importassetassoc command to associate software license information with contract information.

(7) Managing upgrade and downgrade licenses

You can register and manage license information about software upgrades and downgrades.

When you manage upgrade and downgrade licenses, the way of registering the software license information differs from the usual way.

When registering upgrade licenses:

When you upgrade software, in Upgrade Source Name, register information about the upgrade-source software licenses.

For example, if you own 10 licenses for Software A version 2 and purchased 7 upgrade licenses for Software A version 3, when registering software license information about Software A version 3, specify the software license information about Software A version 2 in Upgrade Source Name. As the result, the number of licenses for Software A version 2 is automatically changed from 10 to 3 (so that the number of licenses is not counted redundantly), and you will be able to manage the correct number of licenses after the upgrade.

Tip

You can also use the ioutils importassetassoc command to register upgrade licenses.

When registering downgrade licenses:

When you downgrade software, register the downgrade-destination managed software information as information about software licenses that can be downgraded.

For example, when you own 5 licenses for Software A version 2 and 10 licenses for Software A version 3, if you downgrade 6 licenses from Software A version 3 to Software A version 2, as the software license information about Software A version 3, register 4 usual software licenses and 6 downgrade licenses separately. As information about downgrade software licenses, specify the managed software information about Software A version 2. As the result, the number of owned Software A version 3 licenses becomes 4, and the number of owned Software A version 2 licenses becomes 11 (including the downgrade licenses). Then, you will be able to manage the correct number of licenses after downgrade.

Tip

You can also use the ioutils importassetassoc command to register downgrade licenses.

2.11.4 Managing contract information

In the Contracts view of the Assets module, you can register and manage contract information.

You can register contract information by manually adding information about individual contracts or by importing a CSV file containing the contract information.

Maintain contract information to keep the status up to date. This is especially important when a contract is expired or cancelled, when a related asset is changed, or when a contract term is extended.

Note that you can also update information about contracts in a batch by exporting information about contracts and importing an edited CSV file.

You can also delete contract information for which management is no longer needed.

(1) Managing contract status

For contract information, you can set Contract Status, which indicates whether a contract is valid (within the contract term) or invalid (contract term has ended). Setting Contract Status will let you display a list showing the statuses of the contracts that are entered into. You can also display contracts that have ended, as well as the contracts that are within the contract term.

There are following types of contract statuses:

Active

Indicates that the contract is within the contract term. If a contract for which the contract term has expired has this status, the contract is treated as an expired contract.

Canceled

Indicates that the contract was terminated. Set this status if a contract is cancelled during the contract term.

Expired

Indicates that the contract period has ended.

The administrator can add custom contract statuses (no more than 100 statuses excluding the default contract statuses).

Tip

If you register the contract statuses and contract terms, you can check the contracts for which the expiration date is approaching on a summary report.

(2) Checking the costs for assets

You can check the operational costs for hardware assets or software licenses in reports. You can check the costs for assets, using the following reports under Asset Detail Reports:

All Assets Cost report

Hardware Assets Cost report

Software License Cost report

Other Cost report

For each contract target in the All Assets Cost report or for each contract type in the other reports, you can check the monthly, quarterly, half-yearly, and yearly contract costs for each contract type.

Note that, to check the costs, you must set the costs in contract information and associate it with hardware asset information or software license information.

Tip

By viewing the Other Cost report, you can check the contract costs that are not associated with hardware asset information or software license information.

The following shows the concept of checking the costs for which contract information is associated.

In the above figure, for the lease contract associated with hardware assets, monthly payment is set for the contract term from October to March. Therefore, for the six months of the contract period, $100 is booked monthly. In the same way, for the support contract, $600 is booked monthly for the twelve months of the contract period. For purchase, the lump sum is set, so $1,100 is booked in December.

The monthly amount is summed up based on these calculated amounts, and the amount is booked quarterly, half-yearly, and yearly.

Tip

The amount is summed up for each contract, and does not depend on the number of hardware assets associated with contract information.

Tip

You can also use the ioutils importassetassoc command to associate contract information with hardware asset information and software license information.

(3) Calculating the costs for the all assets

The costs for the all assets are displayed on the All Assets Cost report (under Asset Detail Reports) of the Reports module.

The following describes how the contract costs are calculated.

Costs for each contract target

The total costs of Hardware Assets Cost, Software License Cost, and Other Cost for individual months are displayed. Based on those costs, quarterly, half-yearly, and yearly costs are calculated. For details about how to calculate the costs for hardware assets and hardware licenses, see (4) Calculating the costs for hardware assets and (5) Calculating the costs for software licenses that follow.

Export

You can output the costs summed up for the all assets to a CSV file. The format of an output CSV file is as follows:

For Report Name, List Name, Report Date, Currency Unit, and Report Duration, text strings are output without double quotation marks (").

For the fields other than above, data is output with double quotation marks (").

For a blank column, only a comma (,) is output as a delimiter.

The following is an example of a CSV file.

(4) Calculating the costs for hardware assets

If you associate contract information and hardware asset information, the contract costs are calculated. The costs for hardware assets are displayed on the Hardware Assets Cost report (under Asset Detail Reports) of the Reports module.

The following describes how to calculate the contract costs.

Costs for each contract type

The total costs for individual months are calculated for each contract type. Based on those costs, quarterly, half-yearly, and yearly costs are calculated. The costs for each month is calculated based on the value in Monthly Cost for monthly payment, or on the value in Total Cost for lump sum. A year starts with the month set in the Duration and Start Date view (under Reports) of the Settings module. The costs for twelve months are displayed on the Hardware Assets Cost report (including the date the report is displayed).

The costs are calculated for each contract type based on the conditions below.

The costs for a contract with contract type XXX are calculated below. XXX is one of the following:

Lease

Rent

Maintenance

Support

Fixed

Custom contract types added by the administrator

Method of payment

Calculation

Monthly

Sums up Monthly Cost for the contracts that satisfy all of the following conditions:

Contract Type is XXX.

Payment Mode is Monthly.

Hardware asset information is associated with Hardware Assets (Contract).

The specified month includes the date the costs occurred.

Note that the costs for the Monthly payment occur every month for the period from the start date to the end date of the contract specified in Contract Term.

For example, if Contract Term is 2011/4/10 to 2011/6/10, the costs occur on 2011/4/10, 2011/5/10, and 2011/6/10. Therefore, if the specified month is April in 2011, May in 2011, or June in 2011, the costs are displayed.

Lump Sum

Sums up Total Cost for the contracts that satisfy all of the following conditions:

Contract Type is XXX.

Payment Mode is Lump Sum.

Hardware asset information is associated with Hardware Assets (Contract).

The specified month includes the date the costs occurred.

Note that the costs for a Lump Sum payment occur on the Contract Date.

Export

You can output the costs summed up for hardware assets to a CSV file. The format of an output CSV file is as follows:

For Report Name, List Name, Report Date, Currency Unit, and Report Duration, text strings are output without double quotation marks (").

For the fields other than above, data is output with double quotation marks (").

For a blank column, only a comma (,) is output as a delimiter.

The following is an example of a CSV file.

Note that data is output for customized contract types, in addition to the default contract types.

(5) Calculating the costs for software licenses

If you associate contract information and software license information, the contract costs are calculated. The costs for software licenses are displayed on the Software License Cost report (under Asset Detail Reports) of the Reports module.

The following describes how the contract costs are calculated.

Costs for each contract type

The total costs for individual months are calculated for each contract type. Based on Monthly Cost or Total Cost for individual months, quarterly, half-yearly, and yearly costs are calculated. A year starts with the month set in the Duration and Start Date view (under Reports) of the Settings module. The costs for twelve months are displayed on the Software License Cost report (including the date the report is displayed).

The costs are calculated for each contract type based on the conditions below.

The costs for a contract with contract type XXX are calculated below. XXX is one of the following:

Lease

Rent

Maintenance

Support

Fixed

Custom contract types added by the administrator

Method of payment

Calculation

Monthly

Sums up Monthly Cost for the contracts that satisfy all of the following conditions:

Contract Type is XXX.

Payment Mode is Monthly.

Software license information is associated with Software Licenses (Contract).

The specified month includes the date the costs occurred.

Note that the costs for the Monthly payment occur at every month for the period from the start date to the end date of the contract specified in Contract Term.

For example, if Contract Term is 2011/4/10 to 2011/6/10, the costs occur on 2011/4/10, 2011/5/10, and 2011/6/10. Therefore, if the specified month is April in 2011, May in 2011, or June in 2011, the costs are displayed.

Lump Sum

Sums up Total Cost for the contracts that satisfy all of the following conditions:

Contract Type is XXX.

Payment Mode is Lump Sum.

Software license information is associated with Software Licenses (Contract).

The specified month includes the date the costs occurred.

Note that the costs for the Lump Sum payment occur on the Contract Date.

Export

You can output the costs summed up for software licenses to a CSV file. The format of an output CSV file is as follows:

For Report Name, List Name, Report Date, Currency Unit, and Report Duration, text strings are output without double quotation marks (").

For the fields other than above, data is output with double quotation marks (").

For a blank column, only a comma (,) is output as a delimiter.

The following is an example of a CSV file.

Note that data is output for customized contract types, in addition to the default contract types.

(6) Notification of expired contracts

Based on the contract end dates set in Contract Term in contract information, you can send email notifications of expired contracts.

The function of sending summary reports is used for notification of expired contracts. You can set the summary report notification destinations in the Summary Report Notifications view (under Reports) of the Settings module.

The number of expired contracts is reported by email. A contract is determined to be expired based on the following conditions:

Contract Status is other than Expired or Canceled.

The date of notification is later than the contract end date.

If you want to know the details about expired contracts, click the link in the email body. Clicking the link displays the Reports module. In the Summary Reports view of the Reports module, click the link for an expired contract. You are moved to the Assets module, and here you can check the details about the relevant contract.

Tip

You can also check contract terms on the Expired Contracts (next 3 months) panel.

2.11.5 Associating asset information

You can associate and manage multiple assets. By associating assets with one another, for example, you can check the peripheral devices connected with each computer, or check the costs for the support contracts for software licenses.

Associating information about hardware assets

You can associate and manage multiple hardware assets. By doing so, you can manage multiple assets as a set.

The following is an example when multiple hardware assets are associated.

Tip

To change the association of the hardware asset, you can use the Change button on the tab at the bottom of the information area. To change the associations of multiple assets, use the Action menu.

Tip

You can also use the ioutils importassetassoc command to associate multiple hardware assets with one another.

Associating information about software licenses and information about managed software programs

When you manage the usage status of software licenses, you can associate and manage software licenses and managed software programs.

By associating managed software information with the installed software information collected from devices, you can check the number of used licenses for the managed software programs. You can also associate a managed software program with multiple installed software programs. By doing so, you can manage the software licenses whose volume licenses and versions are different for each managed software program.

For software license information, you can associate the device to which the software license is assigned. By doing so, you will be able to check whether software licenses are being used as assigned, based on the information about the installed software summed up as managed software information.

The following is an example when software licenses are assigned to devices to manage the usage status.

Tip

You can also use the ioutils importassetassoc command to associate software license information with managed software information.

Associating contract information

You can associate contract information with hardware asset information or software license information for management. For example, if you associate maintenance contract information with hardware asset information about computers, you can quickly check the maintenance contract information required when a computer fails, and take countermeasures.

If you set the costs for contract information, you can check the costs for hardware assets or software licenses.

The following is an example when contract information is associated with hardware asset information and software license information.

As for hardware asset information, multiple contracts can be associated with multiple hardware assets according to the contract type.

As for software license information, one contract can be associated with multiple software licenses because contracts are managed for each software license.

Tip

You can associate contract information with either hardware asset information or software license information by specifying the association by setting Contract target in the Add Contract view or the Edit Contract view.

Tip

You can also use the ioutils importassetassoc command to associate contract information with hardware asset information or software license information.

2.11.6 Checking asset information

Checking on the panels in the Home module

In Unconfirmed Hardware Assets on the System Summary panel of the Home module, you can check the number of hardware assets with the Unconfirmed asset status (the number of hardware assets that are newly registered and for which information has not been input). Clicking the link on the number displays the Hardware Assets view of the Assets module, where you can check hardware asset information.

Note that, in Managed Hardware Assets, you can check the total number of hardware assets whose asset status is other than Unconfirmed.

Checking in the Assets module

You can check the asset statuses in the Overview view, Hardware Asset view, Software Licenses view, Managed Software view, Software License Status view, and Contracts view of the Assets module. You can use the Assets module as an asset ledger by registering asset information within an organization.

Tip

In the views other than the Overview view, you can use filters to extract and view the items that satisfy the filter conditions. You can also use the filters provided by this product in the menu area. For details about how to use filters, see 2.17 Using filters.

Checking in the Overview view

You can check an overview of the assets. Clicking a link on a panel displays the view for details, so you can use the Overview view as a portal for asset management.

Checking in the Hardware Asset view

You can register hardware assets within an organization, and check their status in a list. Peripheral devices (such as FD drives and DVD drives) and USB devices are also managed in this view.

You can check the status of stocktaking or search for computers in stock. Associating support contract information with hardware assets will enable you to check the contact information about the support center when problems occur on a specific hardware asset.

Checking in the Software Licenses view

You can register software licenses owned by an organization, and manage them in a list. You can check which devices are allowed to use licenses, as well as checking the number of owned licenses.

By associating contract information with software licenses, you can also check the costs for software license contracts and the contract terms.

Checking in the Managed Software view

You can register information about software programs for which the number of used licenses is to be counted, and check the usage status for each software program. By associating managed software programs and software licenses, you will be able to check the difference between the number of owned licenses and the number of used licenses.

You can also check which computers each software program has been installed on.

Checking in the Software License Status List view

You can manage the usage status of software licenses for each managed software program. The total number of owned licenses and the number of remaining licenses are counted so that you can collectively check the usage status of software licenses.

Checking in the Contracts view

You can register contract information about hardware assets and software licenses, and manage that information in a list. You can check information such as the status and type of a contract, and the expiration date of the contract.

Checking a report

In Summary Reports and Asset Detail Reports, you can check asset status.

In Summary Reports, you can check the hardware assets for which replacement is planned, the usage status of software licenses, and the contracts for which the expiration date is approaching. In Asset Detail Reports, you can check the transition of the number of hardware assets, excess and deficiency of software licenses, and the costs for assets.

Checking in the Events module

In the Events module, you can check events related to asset management, such as registration of assets, changes of asset status, and addition and deletion of software licenses.

(1) Differences between the Inventory module and the Assets module

The following describes the differences between the Inventory module and the Assets module.

Inventory module

The Inventory module is used to check the status of devices currently connected to the network.

The Inventory module displays a list of managed devices. The managed devices are basically connected to the network and communicate with the management server. Therefore, in the Inventory module, you can check the latest information collected from devices, or send notification messages to the displayed devices.

Tip

One license is consumed for one managed device. This means that product licenses are required to display devices in the Inventory module.

In the Software Inventory view of the Inventory module, you can check software information collected from computers in a list. You can check the number of software programs actually installed, and detailed information about software programs.

Assets module

The Assets module is used to manage the assets owned by an organization.

In the Hardware Assets view, you can manage the hardware assets owned by an organization. The owned hardware assets may include devices connected to the network or devices stored offline as stock. Computers and displays might be managed separately. Asset management tasks may include management of disposed assets that no longer exist in an organization. Thus, you can use Hardware Assets view to manage the assets owned by an organization and their statuses regardless of whether the assets can communicate with the management server. You can register and manage hardware assets as you like in the Hardware Assets view.

Tip

No license is needed to register asset information.

Tip

If a device is set to be managed, hardware asset information related to the device is automatically registered in the Hardware Assets view. Therefore, same devices might be displayed in the Inventory module and in the Assets module immediately after JP1/IT Desktop Management 2 is installed.

Furthermore, in the Inventory module, only the information collected from devices is displayed, but in the Assets module, the administrator can input and manage information. If a device management ledger already exists, you can utilize that existing information by importing it to the Assets module.

In the Assets module, you can also manage the usage status of software licenses, as well as hardware assets. In the Software Inventory view of the Inventory module, you can check the number of installed software programs. In the Assets module, you can register the number of software licenses owned by an organization and associate software information with the managed software information, so you will be able to check the difference between the number of used licenses and the total number of licenses. As described above, as for software, the Inventory module is used to check the collected information, but the Assets module is used to check the usage status of software licenses.

Related Topics:

(2) Identifying related devices and hardware assets

2.11.7 Importing asset information

You can import asset information by using a CSV file. By importing asset information, you can add or edit information about assets in a batch. You can import asset information by using the Import Assets wizard or by executing the ioutils importasset command. The following five types of asset information can be imported:

Hardware Assets

Software Licenses

Managed Software

Contracts

Contract Vendor List

(1) Hardware asset fields and formats in imported CSV files

Data in an imported CSV file must be in defined formats. The table below describes the hardware asset fields that can be imported and the defined formats.

Important

Items for which information retrieved from Active Directory or information retrieved from the registry already exists cannot be updated by import.

Tip

When data in a CSV file is imported, the data is associated with the existing hardware asset information, using one of several fields as the mapping key. These fields are Asset #, Serial # (BIOS information), IP Address, MAC Address, Host Name, IMEI, and Contract Phone. When existing hardware asset information is associated, it is updated according to the imported data for the corresponding fields. When the existing hardware asset information is not associated, you can select if the data is registered as new hardware asset information. For details, see the description about how to import hardware asset information in the manual JP1/IT Desktop Management 2 Administration Guide.

Tip

In the Hardware Assets view of the Assets module, if a hyphen (-) is displayed for a field in the information area, the hyphen (-) changes to a null string after hardware asset information is imported. This is done so that hardware asset information can be correctly imported when exported hardware information is imported without change.

Tip

In case of migrating JP1/NETM/DM to JP1/IT Desktop Management 2 system, specify Host ID which has been used for each JP1/NETM/DM client.

When a JP1/NETM/DM client is replaced to JP1/IT Desktop Management 2 Agent and registered as a managed computer in JP1/IT Desktop Management 2, the managed computer is associated with the imported hardware asset information by matching each host ID.

Field

Format of data

Whether can be omitted

Asset #

Alphanumerics with 32 or less characters, and the following signs:

exclamation mark (!), double quotation mark ("), hash mark (#), dollar sign ($), percent sign (%), ampersand (&), single quotation mark ('), left parenthesis ((), right parenthesis ()), asterisk (*), plus sign (+), comma (,), hyphen (-), period (.), slash (/), colon (:), semicolon (;), left angle bracket (<), equal sign (=), right angle bracket (>), question mark (?), at mark (@), left square bracket ([), backslash (\), right square bracket (]), caret (^), underscore (_), grave accent mark (`), left curly bracket ({), vertical bar (|), right curly bracket (}), and swung dash (~)

N

Device Name

A character string with 256 or less characters

Y

Tracked Date

Write in the following format:

mmm/dd/yyyy

mmm: Month, dd: Day, yyyy: Year

If omitted, Jan/01/1970 is set when new hardware asset information is registered.

Y

Description

A character string with 1,024 or less characters

Y

Asset Status

One of the fields registered in Asset Status.

However, you cannot specify Unconfirmed.

If omitted, In Use is set when new hardware asset information is registered.

Y

Planned Asset Status#1

One of the fields registered in Asset Status.

However, you cannot specify Unconfirmed.

Y

Planned Date#1

Write in the following format:

mmm/dd/yyyy

mmm: Month, dd: Day, yyyy: Year

Y

Department

Hierarchical structure of the registered department.

Specify the hierarchical structure with 512 or less characters and with 40 or less hierarchies. Specify each hierarchy name with 256 or less characters. Delimit hierarchies by a slash (/). You can omit a slash (/) at the beginning or at the end of the hierarchical structure. However, even if you omit a slash, one character is counted.#2

Example: /General Affairs Department/Administration Section/

If the specified hierarchy does not exist, a new hierarchy is created when data is imported.

If omitted, Unknown is set when new hardware asset information is registered.

Y

Location

Hierarchical structure of the registered location.

Specify the hierarchical structure with 512 or less characters and with 40 or less hierarchies. Specify each hierarchy name with 256 or less characters. Delimit hierarchies by a slash (/). You can omit a slash (/) at the beginning or at the end of the hierarchical structure. However, even if you omit a slash, one character is counted.#2

Example: /Building A/1F/

If the specified hierarchy does not exist, a new hierarchy is created when data is imported.

If omitted, Unknown is set when new hardware asset information is registered.

Y

User Name

A character string with 256 or less characters#2

Y

E-mail

A character string with 256 or less characters#2

Y

Phone

A character string with 256 or less characters#2

Y

Account

A character string with 256 or less characters#2

Y

Model

A character string with 256 or less characters

Y

Serial #

A character string with 256 or less characters

N

Total Memory

A number in the range from 0 to 9,223,372,036,854,775,807 (in bytes).

You can also add a unit of size (B, KB, MB, GB, TB, or PB) at the end. Do not enter a comma (,) as a delimiter.

Y

Storage Capacity

A number in the range from 0 to 9,223,372,036,854,775,807 (in bytes).

You can also add a unit of size (B, KB, MB, GB, TB, or PB) at the end. Do not enter a comma (,) as a delimiter.

Y

Free Storage Capacity

A number in the range from 0 to 9,223,372,036,854,775,807 (in bytes).

You can also add a unit of size (B, KB, MB, GB, TB, or PB) at the end. Do not enter a comma (,) as a delimiter.

This field is not imported if Device Type is Display.

Y

IP Address

Write in the following format:

nnn.nnn.nnn.nnn

Specify a value in the range from 0.0.0.0 to 255.255.255.255.

N

Subnet Mask

Write in the following format:

nnn.nnn.nnn.nnn

Specify a value in the range from 0.0.0.0 to 255.255.255.255.

Y

MAC Address

Write in the following format (x: 0 to F):

xxxxxxxxxx

xx-xx-xx-xx-xx-xx

xx:xx:xx:xx:xx:xx

Note that you can import data even if hyphens (-) and colons (:) are mixed as delimiters.

N

Host Name

A character string with 256 or less characters

N

Display Type

One of the fields registered in Display Type

Y

Display Size

A number in the range from 0 to 256

Y

Display Graphic Mode

One of the fields registered in Display Graphic Mode

Y

UDID

A character string with 128 or less characters

Y

IMEI

A character string with 64 or less characters

Y

IMSI

A character string with 64 or less characters

Y

ICCID

A character string with 64 or less characters

Y

Carrier

A character string with 512 or less characters

Y

Contract Phone

Numbers, hyphens (-), and plus signs (+)

Y

Device Type

One of the fields registered in Device Type.

If omitted, Unknown is set when new hardware asset information is registered.

Y

CPU

A character string with 256 or less characters

Y

OS

A character string with 256 or less characters

Y

Manufacturer

A character string with 256 or less characters

Y

Custom Fields

Data type set in the Asset Field Definitions view (under Assets) of the Settings module

Y #3

Device instance ID

Alphanumeric characters and the following signs, with 256 or less characters:

exclamation mark (!), double quotation mark ("), hash mark (#), dollar sign ($), percent sign (%), ampersand (&), single quotation mark ('), left parenthesis ((), right parenthesis ()), asterisk (*), plus sign (+), comma (,), hyphen (-), period (.), slash (/), colon (:), semicolon (;), left angle bracket (<), equal sign (=), right angle bracket (>), question mark (?), at mark (@), left square bracket ([), backslash (\), right square bracket (]), caret (^), underscore (_), grave accent mark (`), left curly bracket ({), vertical bar (|), right curly bracket (}), and swung dash (~)

Y

Host ID#4

Numerics, uppercase letters, and the following signs, with 64 or less characters:

hash mark (#), hyphen (-), and period (.)

Y

Legend: Y: The setting can be omitted. N: At least one specification is required.

#1: A set of Planned Asset Status and Planned Date must be imported.

#2: If the data type is Text and characters for the field is restricted, data in a CSV file must follow the restrictions.

#3: Setting is required for custom fields that require input.

#4: If the host ID value is written in a imported file, the host ID cannot be modified after the import.

Tip

The fields to be imported do not have to be enclosed by double quotation marks ("). However, if the data to be imported includes a comma (,), enclose the data by double quotation marks ("). For example, when you import AB,CD, specify it as "AB,CD".

Important

There is a case where temporary load increase happens during the asset information import, causing the import to fail. In this case, perform any of the following procedure, and re-execute the asset information import.

Re-execute the asset information import when the amount of inventory information notification from agent is low.

Temporarily stop any of the following service and re-execute the asset information import. After the import is finished, restart the service.

- JP1_ITDM2_Agent Control

- JP1_ITDM2_Service

Important

For management field registered on Hardware assets information, if the data source of the field is Registry, the field will not be updated by import. To update using import, by temporarily changing the data source to System Administrator, updating by import is possible until inventory information is notified from Agent.

(2) Software license fields and formats in imported CSV files

Data in an imported CSV file must be in defined formats. The table below describes the software license fields that can be imported and their formats.

Tip

When data in a CSV file is imported, the data is associated with the existing software license information, using License # as the mapping key. When the existing software license information is associated, it is updated according to the imported data for the corresponding fields. When the existing software license information is not associated, the imported data is registered as new software license information.

Field

Format of data

Whether can be omitted

License #

Alphanumerics with 32 or less characters, and the following signs:

exclamation mark (!), double quotation mark ("), hash mark (#), dollar sign ($), percent sign (%), ampersand (&), single quotation mark ('), left parenthesis ((), right parenthesis ()), asterisk (*), plus sign (+), comma (,), hyphen (-), period (.), slash (/), colon (:), semicolon (;), left angle bracket (<), equal sign (=), right angle bracket (>), question mark (?), at mark (@), left square bracket ([), backslash (\), right square bracket (]), caret (^), underscore (_), grave accent mark (`), left curly bracket ({), vertical bar (|), right curly bracket (}), and swung dash (~)

N

License Name

A character string with 256 or less characters

Y

License Type

One of the fields registered in License Type

If omitted, Install License is set when new software license information is registered.

Y

Total Licenses

A number in the range from 0 to 2,147,483,647

If omitted, Unlimited is set when new software license information is registered. Do not enter a comma (,) as a delimiter.

Y

Tracked Date

Write in the following format:

mmm/dd/yyyy

mmm: Month, dd: Day, yyyy: Year

Y

Department

Hierarchical structure of the registered department.

Specify the hierarchical structure with 512 or less characters and with 40 or less hierarchies. Specify each hierarchy name with 256 or less characters. Delimit hierarchies by a slash (/). You can omit a slash (/) at the beginning or at the end of the hierarchical structure. However, even if you omit a slash, one character is counted.#3

Example: /General Affairs Department/Administration Section/

If the specified hierarchy does not exist, a new hierarchy is created when data is imported.

If omitted, Unknown is set when new hardware asset information is registered.

Y

Description

A character string with 1,024 or less characters

Y

License Status

One of the fields registered in License Status

If omitted, In Use is set when new software license information is registered.

Y

Planned License Status#1

One of the fields registered in License Status

Y

Planned Date#1

Write in the following format:

mmm/dd/yyyy

mmm: Month, dd: Day, yyyy: Year

Y

Custom Fields

Data type set in the Asset Field Definitions view (under Assets) of the Settings module

Y #2

Legend: Y: The setting can be omitted. N: The setting cannot be omitted.

#1: A set of Planned Asset Status and Planned Date must be imported.

#2: Setting is required for custom fields that require input.

#3: If the data type is Text and the number of characters for the field is restricted, data in a CSV file must follow the restrictions.

Tip

The fields to be imported do not have to be enclosed by double quotation marks ("). However, if the data to be imported includes a comma (,), enclose the data by double quotation marks ("). For example, when you import AB,CD, specify it as "AB,CD".

(3) Managed software fields and formats in imported CSV files

Data in an imported CSV file must be in defined formats. The table below describes the managed software fields that can be imported and their formats.

Tip

When data in a CSV file is imported, the data is associated with the existing managed software information, using Managed Software Name as the mapping key. When the existing managed software information is associated, it is updated according to the imported data for the corresponding fields in the imported data. When the existing managed software information is not associated, the imported data is registered as new managed software information.

Field

Format of data

Whether can be omitted

Managed Software Name

A character string with 512 or less characters

N

Software Vendor

A character string with 128 or less characters

Y

Description

A character string with 1,024 or less characters

Y

OS Type

The following character strings:

All

Windows

Linux

Mac OS

HP-UX

Solaris

AIX

Y

Legend: Y: The setting can be omitted. N: The setting cannot be omitted.

Tip

The fields to be imported do not have to be enclosed by double quotation marks ("). However, if the data to be imported includes a comma (,), enclose the data by double quotation marks ("). For example, when you import AB,CD, specify it as "AB,CD".

(4) Contract fields and formats in imported CSV files

Data in an imported CSV file must be in defined formats. The table below describes the contract fields that can be imported and their formats.

Tip

When data in a CSV file is imported, the data is associated with the existing contract information, using Contract # as the mapping key. When the contract information is associated, it is updated according to the imported data for the corresponding fields. When the contract information is not associated, the imported data is registered as new contract information.

Field

Format of data

Whether can be omitted

Contract #

Alphanumerics with 32 or less characters, and the following signs:

exclamation mark (!), double quotation mark ("), hash mark (#), dollar sign ($), percent sign (%), ampersand (&), single quotation mark ('), left parenthesis ((), right parenthesis ()), asterisk (*), plus sign (+), comma (,), hyphen (-), period (.), slash (/), colon (:), semicolon (;), left angle bracket (<), equal sign (=), right angle bracket (>), question mark (?), at mark (@), left square bracket ([), backslash (\), right square bracket (]), caret (^), underscore (_), grave accent mark (`), left curly bracket ({), vertical bar (|), right curly bracket (}), and swung dash (~)

N

Contract Name

A character string with 256 or less characters

Y

Contract Type

One of the fields registered in Contract Type

If omitted, Fixed is set when new contract information is registered.

Y

Contract Target

One of the following:

Hardware Asset

Software License

Other

If omitted, Other is set when new contract information is registered.

Y

Contract Date

Write in the following format:

mmm/dd/yyyy

mmm: Month, dd: Day, yyyy: Year

Y

Contract Start Date

Write in the following format:

mmm/dd/yyyy

mmm: Month, dd: Day, yyyy: Year

Y #1

Contract End Date

Write in the following format:

mmm/dd/yyyy

mmm: Month, dd: Day, yyyy: Year

Y #1

Contract Status

One of the fields registered in Contract Status

If omitted, Active is set when new contract information is registered.

Y

Department

Hierarchical structure of the registered department.

Specify the hierarchical structure with 512 or less characters and with 40 or less hierarchies. Specify each hierarchy name with 256 or less characters. Delimit hierarchies by a slash (/). You can omit a slash (/) at the beginning or at the end of the hierarchical structure. However, even if you omit a slash, one character is counted.#4

Example: /General Affairs Department/Administration Section/

If the specified hierarchy does not exist, a new hierarchy is created when data is imported.

If omitted, Unknown is set when new hardware asset information is registered.

Y

Payment Mode

Either of the following:

Monthly

Lump Sum

N

Monthly Cost

A number in the range from 0 to 9,223,372,036,854,775,807

Write this field when Payment Mode is Monthly. Do not enter a comma (,) as a delimiter.

Y#1

Total Cost

A number in the range from 0 to 9,223,372,036,854,775,807

Write this field when Payment Mode is Lump Sum. Do not enter a comma (,) as a delimiter.

Y #2

Description

A character string with 1,024 or less characters

Y

Custom Fields

Data type set in the Asset Field Definitions view (under Assets) of the Settings module

Y #3

Legend: Y: The setting can be omitted. N: The setting cannot be omitted.

#1: When Payment Mode is Monthly, Contract Start Date, Contract End Date, and Monthly Cost must be set.

#2: Setting is required when Payment Mode is Lump Sum.

#3: For custom fields that require input, be sure to set for the field.

#4: If the data type is Text and the number of characters for the field is restricted, data in a CSV file must follow the restrictions.

Tip

The fields to be imported do not have to be enclosed by double quotation marks ("). However, if the data to be imported includes a comma (,), enclose the data by double quotation marks ("). For example, when you import AB,CD, specify it as "AB,CD".

(5) Contract vendor fields and formats in imported CSV files

Data in an imported CSV file must be in defined formats. The table below describes the contract vendor fields that can be imported and their formats.

Tip

When data in a CSV file is imported, the data is associated with the existing contract vendor information, using Contract Vendor Name as the mapping key. When the contract vendor information is associated, it is updated according to the imported data for the corresponding fields. When the contract vendor information is not associated, the imported data is registered as new contract vendor information.

Field

Format of data

Whether can be omitted

Contract Vendor Name

A character string with 256 or less characters

N

Address

A character string with 256 or less characters

Y

Phone

A number with 256 or less characters, hyphen (-), or plus sign (+)

Y

E-mail

A character string with 256 or less characters

Y

Contact Person

A character string with 256 or less characters

Y

Description

A character string with 1,024 or less characters

Y

Legend: Y: The setting can be omitted. N: The setting cannot be omitted.

Tip

The fields to be imported do not have to be enclosed by double quotation marks ("). However, if the data to be imported includes a comma (,), enclose the data by double quotation marks ("). For example, when you import AB,CD, specify it as "AB,CD".

2.11.8 Exporting asset information

You can export asset information to a CSV file. Exported asset information can be used on other management servers or by other software programs. You can export asset information from the Action menu or by executing the ioutils exportasset command. You can export the following five types of asset information:

Hardware Asset Information#

Software License Information

Managed Software Information

Contract Information

Contract Vendor List

The host ID for the Hardware Asset Information can only be exported when you execute export from the ioutils exportasset command.

Tip

The administrator can specify the fields to be exported and target data to create a list suitable for a specific purpose.

For details about the data format output for each type of information, see the related links.

Related Topics:

(1) Hardware asset fields and formats in imported CSV files

(2) Software license fields and formats in imported CSV files

(3) Managed software fields and formats in imported CSV files

(4) Contract fields and formats in imported CSV files

(5) Contract vendor fields and formats in imported CSV files

2.11.9 Importing asset association information

By using a CSV file, you can import asset association information. You can add all imported asset associations to the list or edit them. The ioutils importassetassoc command is available to import asset association information. Each of the following assets can be associated with any one of the assets listed under it for import:

Hardware asset

Device

Hardware asset

Contract

Software license

Managed software

License to be upgraded

Device

Contract

Managed software

Software

Software license

Contract

Hardware asset

Software license

Contract vendor list

Note

Hereafter, an asset association will be expressed as follows:

asset-information -> relevant-asset-information

For example, hardware asset information associated with device information can be expressed as "Hardware asset -> Device."

(1) Coding format of a CSV file used to import asset association information

Data inside the CSV file to be used for import must be coded according to the prescribed coding format. Specific combinations of asset items that can be associated with one another for import as well as a coding format appropriate for each combination of asset information items are provided below.

Note

Each CSV file you create for import can only list information pertaining to a specific combination of asset items. For example, there must be one CSV file that lists information regarding the "Hardware asset -> Device" association and another CSV file that lists information regarding the "Hardware asset -> Contract" association.

Tip

You do not have to enclose each data item to be imported in double quotation marks ("), except when the data item contains a comma (,). For example, when the data item to be imported is AB,CD, it must be coded as "AB,CD".

Tip

When a certain asset does not have any assets associated with it, you can simply leave the second and subsequent columns beside it in the CSV file blank.

When a certain asset is associated with multiple assets, use one row to describe each association.

When you have multiple rows to describe the multiple assets with which a certain asset can be associated, any rows among them that do not show an associated asset will be treated as invalid data.

Hardware asset -> Device

The association shown at the top of the list in the CSV file corresponds to the representative device.

One asset number can be associated with multiple host IDs.

Column position in the CSV file

Item

Format of Data

1

Asset #

Alphanumerics with 32 or less characters, and the following signs:

exclamation mark (!), double quotation mark ("), hash mark (#), dollar sign ($), percent sign (%), ampersand (&), single quotation mark ('), left parenthesis ((), right parenthesis ()), asterisk (*), plus sign (+), comma (,), hyphen (-), period (.), slash (/), colon (:), semicolon (;), left angle bracket (<), equal sign (=), right angle bracket (>), question mark (?), at mark (@), left square bracket ([), backslash (\), right square bracket (]), caret (^), underscore (_), grave accent mark (`), left curly bracket ({), vertical bar (|), right curly bracket (}), and swung dash (~)

2

Host ID

Numerics, uppercase letters, and the following signs, with 64 or less characters:

hash mark (#), hyphen (-), and period (.)

Hardware asset -> Hardware asset

One asset number can be associated with multiple other asset numbers. Hardware assets to be associated with the main hardware asset must have asset numbers that are different from the one assigned to the main asset.

Column position in the CSV file

Item

Format of Data

1

Asset #

Alphanumerics with 32 or less characters, and the following signs:

exclamation mark (!), double quotation mark ("), hash mark (#), dollar sign ($), percent sign (%), ampersand (&), single quotation mark ('), left parenthesis ((), right parenthesis ()), asterisk (*), plus sign (+), comma (,), hyphen (-), period (.), slash (/), colon (:), semicolon (;), left angle bracket (<), equal sign (=), right angle bracket (>), question mark (?), at mark (@), left square bracket ([), backslash (\), right square bracket (]), caret (^), underscore (_), grave accent mark (`), left curly bracket ({), vertical bar (|), right curly bracket (}), and swung dash (~)

2

Asset #

Hardware asset -> Contract

One asset number can be associated with multiple contract numbers. You cannot specify the contract numbers corresponding to the contracts associated with software licenses.

Column position in the CSV file

Item

Format of Data

1

Asset #

Alphanumerics with 32 or less characters, and the following signs:

exclamation mark (!), double quotation mark ("), hash mark (#), dollar sign ($), percent sign (%), ampersand (&), single quotation mark ('), left parenthesis ((), right parenthesis ()), asterisk (*), plus sign (+), comma (,), hyphen (-), period (.), slash (/), colon (:), semicolon (;), left angle bracket (<), equal sign (=), right angle bracket (>), question mark (?), at mark (@), left square bracket ([), backslash (\), right square bracket (]), caret (^), underscore (_), grave accent mark (`), left curly bracket ({), vertical bar (|), right curly bracket (}), and swung dash (~)

2

Contract #

Software license -> Managed software

One license number can be associated with only one managed software name.

Column position in the CSV file

Item

Format of Data

1

License #

Alphanumerics with 32 or less characters, and the following signs:

exclamation mark (!), double quotation mark ("), hash mark (#), dollar sign ($), percent sign (%), ampersand (&), single quotation mark ('), left parenthesis ((), right parenthesis ()), asterisk (*), plus sign (+), comma (,), hyphen (-), period (.), slash (/), colon (:), semicolon (;), left angle bracket (<), equal sign (=), right angle bracket (>), question mark (?), at mark (@), left square bracket ([), backslash (\), right square bracket (]), caret (^), underscore (_), grave accent mark (`), left curly bracket ({), vertical bar (|), right curly bracket (}), and swung dash (~)

2

Managed Software Name

A character string with 512 or less characters

Software license -> License to be upgraded

One license number can be associated with only one license number corresponding to the software license to be upgraded.

You cannot specify a license number corresponding to a software license that meets any one of the conditions described below. You can check detailed information regarding each software license by displaying the Software Licenses view in the Assets module or by exporting the same data. If the software license in question meets any of the following conditions, specify a different license number and then proceed to associate that license number with the license number corresponding to the software license to be upgraded.

The license type differs between the upgrade license and the software license to be upgraded.

The upgrade license is identical to the software license to be upgraded.

The number of the software licenses to be upgraded is fewer than the total number of upgrade licenses.

The license to be upgraded is a limited license, whereas the upgrade license is an unlimited license.

Column position in the CSV file

Item

Format of Data

1

License #

Alphanumerics with 32 or less characters, and the following signs:

exclamation mark (!), double quotation mark ("), hash mark (#), dollar sign ($), percent sign (%), ampersand (&), single quotation mark ('), left parenthesis ((), right parenthesis ()), asterisk (*), plus sign (+), comma (,), hyphen (-), period (.), slash (/), colon (:), semicolon (;), left angle bracket (<), equal sign (=), right angle bracket (>), question mark (?), at mark (@), left square bracket ([), backslash (\), right square bracket (]), caret (^), underscore (_), grave accent mark (`), left curly bracket ({), vertical bar (|), right curly bracket (}), and swung dash (~)

2

License # to be upgraded

Software license -> Device

One license number can be associated with multiple host IDs. You cannot specify the host IDs of detected devices.

Column position in the CSV file

Item

Format of Data

1

License #

Alphanumerics with 32 or less characters, and the following signs:

exclamation mark (!), double quotation mark ("), hash mark (#), dollar sign ($), percent sign (%), ampersand (&), single quotation mark ('), left parenthesis ((), right parenthesis ()), asterisk (*), plus sign (+), comma (,), hyphen (-), period (.), slash (/), colon (:), semicolon (;), left angle bracket (<), equal sign (=), right angle bracket (>), question mark (?), at mark (@), left square bracket ([), backslash (\), right square bracket (]), caret (^), underscore (_), grave accent mark (`), left curly bracket ({), vertical bar (|), right curly bracket (}), and swung dash (~)

2

Host ID

Numerics, uppercase letters, and the following signs, with 64 or less characters:

hash mark (#), hyphen (-), and period (.)

Software license -> Contract

One license number can be associated with only one contract number. You cannot specify a contract number corresponding to the contract associated with a hardware asset.

Column position in the CSV file

Item

Format of Data

1

License #

Alphanumerics with 32 or less characters, and the following signs:

exclamation mark (!), double quotation mark ("), hash mark (#), dollar sign ($), percent sign (%), ampersand (&), single quotation mark ('), left parenthesis ((), right parenthesis ()), asterisk (*), plus sign (+), comma (,), hyphen (-), period (.), slash (/), colon (:), semicolon (;), left angle bracket (<), equal sign (=), right angle bracket (>), question mark (?), at mark (@), left square bracket ([), backslash (\), right square bracket (]), caret (^), underscore (_), grave accent mark (`), left curly bracket ({), vertical bar (|), right curly bracket (}), and swung dash (~)

2

Contract #

Managed software -> Software

One managed software name can be associated with multiple software names. You can specify software names and product IDs that have not been registered in the database. You cannot specify a product ID when Full-product version is specified as the purchasing status.

Column position in the CSV file

Item

Format of Data

1

Managed Software Name

A character string with 512 or less characters

2

Software Name

A character string with 512 or less characters

3

Purchasing Status

Either one of the following values:

Volume license version

Full-product version

4

Product ID

A string of no more than 64 ASCII characters that does not include control characters.

The specifiable combinations of Software Name, Purchasing Status, and Product ID are as follows:

Software Name: software-name, Purchasing Status: blank, Product ID: blank

Software Name: software-name, Purchasing Status: purchasing-status, Product ID: blank

Software Name: software-name, Purchasing Status: purchasing-status, Product ID: product-ID

Managed software -> Software license

One managed software name can be associated with multiple license numbers.

Column position in the CSV file

Item

Format of Data

1

Managed Software Name

A character string with 512 or less characters

2

License #

Alphanumerics with 32 or less characters, and the following signs:

exclamation mark (!), double quotation mark ("), hash mark (#), dollar sign ($), percent sign (%), ampersand (&), single quotation mark ('), left parenthesis ((), right parenthesis ()), asterisk (*), plus sign (+), comma (,), hyphen (-), period (.), slash (/), colon (:), semicolon (;), left angle bracket (<), equal sign (=), right angle bracket (>), question mark (?), at mark (@), left square bracket ([), backslash (\), right square bracket (]), caret (^), underscore (_), grave accent mark (`), left curly bracket ({), vertical bar (|), right curly bracket (}), and swung dash (~)

Contract -> Hardware asset

One contract number can be associated with multiple asset numbers. A contract associated with a software license cannot be associated with hardware assets.

Column position in the CSV file

Item

Format of Data

1

Contract #

Alphanumerics with 32 or less characters, and the following signs:

exclamation mark (!), double quotation mark ("), hash mark (#), dollar sign ($), percent sign (%), ampersand (&), single quotation mark ('), left parenthesis ((), right parenthesis ()), asterisk (*), plus sign (+), comma (,), hyphen (-), period (.), slash (/), colon (:), semicolon (;), left angle bracket (<), equal sign (=), right angle bracket (>), question mark (?), at mark (@), left square bracket ([), backslash (\), right square bracket (]), caret (^), underscore (_), grave accent mark (`), left curly bracket ({), vertical bar (|), right curly bracket (}), and swung dash (~)

2

Asset #

Contract -> Software license

One contract number can be associated with multiple license numbers. A contract associated with hardware assets cannot be associated with software licenses.

Column position in the CSV file

Item

Format of Data

1

Contract #

Alphanumerics with 32 or less characters, and the following signs:

exclamation mark (!), double quotation mark ("), hash mark (#), dollar sign ($), percent sign (%), ampersand (&), single quotation mark ('), left parenthesis ((), right parenthesis ()), asterisk (*), plus sign (+), comma (,), hyphen (-), period (.), slash (/), colon (:), semicolon (;), left angle bracket (<), equal sign (=), right angle bracket (>), question mark (?), at mark (@), left square bracket ([), backslash (\), right square bracket (]), caret (^), underscore (_), grave accent mark (`), left curly bracket ({), vertical bar (|), right curly bracket (}), and swung dash (~)

2

License #

Contract -> Contract vendor list

One contract number can be associated with only one contract vendor name.

Column position in the CSV file

Item

Format of Data

1

Contract #

Alphanumerics with 32 or less characters, and the following signs:

exclamation mark (!), double quotation mark ("), hash mark (#), dollar sign ($), percent sign (%), ampersand (&), single quotation mark ('), left parenthesis ((), right parenthesis ()), asterisk (*), plus sign (+), comma (,), hyphen (-), period (.), slash (/), colon (:), semicolon (;), left angle bracket (<), equal sign (=), right angle bracket (>), question mark (?), at mark (@), left square bracket ([), backslash (\), right square bracket (]), caret (^), underscore (_), grave accent mark (`), left curly bracket ({), vertical bar (|), right curly bracket (}), and swung dash (~)

2

Contract Vendor Name

A character string with 256 or less characters

CSV file coding example

Shown below is an example of how to code the "Hardware asset -> Contract" associations in a CSV file. Specifically, the example below describes the following associations:

Asset number AssetNo001 that is associated with contract number ContractNo001

Asset number AssetNo002 that is associated with none of the contract numbers

• Asset number AssetNo003 that is associated with contract numbers ContractNo003 and ContractNo004

AssetNo001, ContractNo001
AssetNo002,
AssetNo003, ContractNo003
AssetNo003, ContractNo004

2.11.10 Exporting asset association information

Asset association information can be exported to a CSV file. You can use the exported asset association information in another management server or software. You can export asset association information by executing the ioutils exportassetassoc command. Each of the following assets can be associated with any one of the assets listed under it for export:

Hardware asset

Device

Hardware asset

Contract

Software license

Managed software

License to be upgraded

Device

Contract

Managed software

Software

Software license

Contract

Hardware asset

Software license

Contract vendor list

Note

Hereafter, an asset association will be expressed as follows:

asset-information -> relevant-asset-information

For example, hardware asset information associated with device information can be expressed as "Hardware asset -> Device."

Note

Hardware assets with no asset numbers set for them will not be exported.

For details about the output data format, see the related topic.

Related Topics:

(1) Coding format of a CSV file used to import asset association information

2.12 Distributing software and files by using Remote Install Manager

In JP1/IT Desktop Management 2, you can distribute software and files in a single operation from the management server to users' computers via the network. This section describes the flow of distributing software by using Remote Install Manager. For details and operation procedures, see the JP1/IT Desktop Management 2 Distribution Function Administration Guide.

Important

The distribution of software and files by using Remote Install Manager is not possible for API-controlled devices.

The following describes the flow of distributing software.

Register (package) the software to be distributed.

Register (package) the software you want to install on a user's computer to the management server. To package the software, use Packager, a component of JP1/IT Desktop Management 2 - Agent. You can specify the install condition of the distributed software when you package the software. A group of packaged software programs is called a package.

Execute a job and distribute (remotely install) the package.

Use Remote Install Manager to create a job in which distribution-destination computers and distribution schedule are defined, and execute the job. For example, if you execute a job as defined in the figure above, the package will be distributed only to the computers belonging to the accounting department, at the same time, on September 1, 2014.

Checking the distribution status and execution results

Check the distribution status and execution results in the Job status window of Remote Install Manager. If distribution to a computer failed, take actions accordingly, and re-execute the job.

Rather than the system administrator distributing software to users' computers, you can instead allow users to select software and install it by themselves.

Tip

You can distribute a file larger than 2 gigabytes when using Remote Install Manager. For details, see the description on Distributing a file larger than 2 gigabytes in the JP1/IT Desktop Management 2 Distribution Function Administration Guide.

Tip

You can package and distribute Windows updates and a feature update to Windows 10 by using Remote Install Manager. For details, see the description of managing updates in the manual JP1/IT Desktop Management 2 Distribution Function Administration Guide.

2.12.1 Distributing files efficiently using Remote Install Manager

JP1/IT Desktop Management 2 provides features to efficiently perform distribution using Remote Install Manager. This section describes some of the features.

Load share using a relay system

Install a relay system when you have a large scale network or JP1/IT Desktop Management 2 has many managed computers. Installing a relay system can reduce loads on the management server.

Grouping distribution-destination computers.

You can group distribution-destination computers according to their purposes. By grouping computers, you can specify a group of destinations in a single operation. A computer can belong to multiple groups.

The following figure shows a configuration grouped by a department and by a project.

Setting installation conditions

Among the distribution-destination computers, you can perform installation only on the computers that satisfy the specified conditions. You create the conditions when packaging software or when creating a job, and the conditions are judged when the job is executed.

For example, you can configure to install a software program only on computers running Windows 7, or not to install a program on computers whose hard disk free space is 5 GB or less. In addition to conditions on hardware, you can check if a specific software is installed as a condition, or you can create a unique condition by launching an external program provided by the system administrator before installing software.

Specifying a date and time for distribution and for installation

You can specify a date and time on which a package is distributed (data is transferred) to computers, and a date and time on which software is installed on the computers.

Distribution date and time

You can specify a job execution date and time when you create a job. For example, you can distribute packages without placing a load on the network by specifying a job to be executed at nighttime.

Installation date and time

You can specify a time that a package is installed, when you package software, or when you create a job. This allows you to install or upgrade a program at a specified date and time on all destination computers.

Split distribution of a package

You can split a package by a specified volume rather than distributing it at a time. You can also specify a time interval (distribution interval), so that you can reduce the network load when distributing a high-volume package.

Multicast distribution

In normal unicast distribution of a package, the more the number of destination computers, the higher the number of packets sent from an upper-level system ( management server or relay system). In multicast distribution of a package, all that is sent is the number of packets for a single job. A smaller number of packets can reduce load on the network.

Suspending and resuming a job

You can suspend a job temporarily. For example, if you planned to distribute software during non-business hours, but could not complete the distribution, you can suspend a job to stop the distribution temporarily, and then resume distribution during the next non-business hours.

Controlling distribution-destination computers

If a distribution-destination computer supports AMT or Wake on LAN, you can automatically turn that computer on or off. For example, you can turn on a shut-down computer during the nighttime, or on holidays, when the network load is light.

Reducing workload through distribution

You can reduce the network load by controlling the amount of network bandwidth used by the distribution function, which uses Remote Install Manager. You can specify the maximum transfer speed in the configuration file (jdn_rim_distr_bwc.conf) to control the amount of network bandwidth used, so that data is transferred at a speed not exceeding the specified value. If the total amount of data transferred per second exceeds the specified maximum transfer speed, the management server will suppress the data transfer.

For details on how to specify the maximum transfer speed in the configuration file (jdn_rim_distr_bwc.conf), see the description of how to control the amount of network bandwidth used for distribution in the JP1/IT Desktop Management 2 Configuration Guide.

Tip

You can also use relay system to set the highest transfer rate in the configuration file (jdn_rim_distr_bwc.conf).

If relay system is using network bandwidth as control, relay system Publishing Log (MAIN.LOG) displays event log messages related to network bandwidth's control.

If a timeout occurs during distribution because the value of the maximum transfer speed is small, take one or more of the following actions:

Increase the value of the maximum transfer speed.

Reduce the number of agents that are connected at the same time.

For details, see the description of how to adjust the number of hosts that are connected at the same time in the JP1/IT Desktop Management 2 Distribution Function Administration Guide.

Tip

The flow rate is not controlled in the following situations:

While the remote collection function is collecting files

When software and files are distributed with multicast distribution enabled

2.12.2 Distributing packages to computers managed offline by using Remote Install Manager

You can distribute a package to computers managed offline without using the network. This feature is called offline installation. Offline installation is useful when you want to distribute a package to a standalone computer, or when you want to distribute a high-volume package without placing a load on the network.

To perform offline installation, store a package or data for offline installation on a media such as CD-R or USB memory device, and then execute the installation execution program on the distribution destination computer.

2.13 Distributing software and files to computers managed online (ITDM-compatible distribution)

It is usually impractical for administrators to visit the computers within an organization to install new software or uninstall prohibited software.

JP1/IT Desktop Management 2 can use a management server to execute remote operations (such as installing and uninstalling software, and distributing files) on computers managed online. This functionality can reduce the time and effort of software installation or management. Also, software maintenance will become easier. For example, the administrator can install the latest versions of software programs in batch operations.

When you want to apply update files for the business system to all computers within an organization you could, for example, send the files by attaching them to emails or ask users to download the files. However, in such cases, you cannot ensure that the update files are applied to all computers. However, by using JP1/IT Desktop Management 2 to distribute files, you can understand the distribution status and ensure that the files are applied to all computers.

Important

The distribution of software and files is not possible for API-controlled devices.

In a multi-server configuration, ITDM-compatible distribution can target only the computers directly under the management server. If you want to distribute to all the computers under the server, use Remote Install Manager for distribution. Note that you cannot use ITDM-compatible distribution for an agent for UNIX or Mac. For an agent for UNIX or Mac, you must use Remote Install Manager for distribution.

Tip

By using the distribution function, you can automatically install mandatory software or uninstall prohibited software based on the results of security judgment for software in use.

Tip

If packages must be distributed to many devices, we recommend that you distribute the packages at different times. This is because distributing packages from the management server to many devices at the same time might overload the management server or network.

2.13.1 Managing packages and tasks (ITDM-compatible distribution)

You can use JP1/IT Desktop Management 2 to register and manage packages and tasks for installing software on target computers or for distributing files.

Definition of a package (ITDM-compatible distribution) and task

Package (ITDM-compatible distribution)

A package (ITDM-compatible distribution) is a set of software programs and files to be distributed to computers, and which are registered in JP1/IT Desktop Management 2 in the operation window. You can manage ITDM-compatible distribution packages in the Packages view of the Distribution (ITDM-compatible) module.The packages in this view are the packages to be distributed using the Distribution (ITDM-compatible) module. If you want to perform distribution using Remote Install Manager, you must create a package using Packager.

For software programs registered as an ITDM-compatible distribution package, you can set installation commands to perform silent installation of the software programs on distribution-destination computers. For the files registered as an ITDM-compatible distribution package, you can distribute the files to computers.

For details about managing ITDM-compatible distribution packages, see (1) Managing packages.

Task

A task defines an execution schedule or action on the target computers, for distributing ITDM-compatible distribution packages to computers, or for uninstalling software from computers. You can manage tasks in the Tasks view of the Distribution (ITDM-compatible) module.

When you create a task for distributing an ITDM-compatible distribution package, the package is distributed to computers based on the execution schedule. When you create a task for uninstalling software, software is uninstalled from computers based on the execution schedule.

For details about managing tasks, see (2) Managing tasks.

Usage of packages (ITDM-compatible distribution) and tasks

Installing software

In the Packages view of the Distribution (ITDM-compatible) module, register an ITDM-compatible distribution package for the software you want to install. Then, in the Tasks view of the Distribution (ITDM-compatible) module, create a task for distributing the package. You can also use the Install Wizard to install software.

However, for Windows Store apps, you can register an installation task but the actual installation will not be performed. If you want to install a Windows Store app, perform the operation individually on the target computer.

Distributing files

In the Packages view of the Distribution (ITDM-compatible) module, register an ITDM-compatible distribution package for the files you want to distribute. Then, in the Tasks view of the Distribution (ITDM-compatible) module, create a task for distributing the package. You can also use the File Distribution Wizard to distribute files.

Uninstalling software

In the Tasks view of the Distribution (ITDM-compatible) module, create an uninstallation task. You can also use the Uninstall Wizard to uninstall software. Software will be uninstalled when its name and version exactly match the specified software in the task.

However, for Windows Store apps, you can register an uninstallation task but the actual uninstallation will not be performed. If you want to uninstall a Windows Store app, perform the operation individually on the target computer.

Related Topics:

2.13.3 Preparation for distribution (ITDM-compatible distribution)

(1) Managing packages

In the Packages view of the Distribution (ITDM-compatible) module, you can create and manage packages.

You can also edit created packages. Registered data cannot be changed, but you can change such information as the installation commands and installation folders.

You can also delete unnecessary packages.

Access permissions for distributed packages are inherited from the distribution-destination folder. Access permissions for distributed packages can be changed on the distribution-destination computer by the user.

Important

If the same file as a distributed package already exists at the distribution destination, access permissions for the distributed package are inherited from the existing file's access permissions.

Files to be registered in a package

The following table describes how to specify the files for individual types of packages you create.

Type

Files to be registered in a package

Software installation

If the software to be installed is an MSI file or EXE file, register that file.

If the software to be installed contains multiple MSI files or EXE files or if other files than an MSI file or EXE file are required for installation, compress them in a ZIP file and register the ZIP file. You can store MSI or EXE files in any location in the ZIP file.

File distribution

If you want to distribute only one file, register that file.

If you want to distribute multiple files at the same time, compress them in a ZIP file and register the ZIP file.

Tip

The maximum size of a file that can be registered in a package is 1 GB. If the file is a ZIP file, the total size of the unzipped files must also be no more than 2 GB.

If the size of the file is more than 2 GB, split the file so that each piece of the file is less than or equal to 1 GB, distribute the pieces, and then combine the split files after the distribution.

Tip

Only software programs that support silent installation can be installed. Silent installation automatically performs installation on users' computers without displaying windows for installation. If the software to be installed is an MSI file, a silent installation command is automatically set when the package is created. If the software to be installed is an EXE file, a silent installation command must be manually specified.

Tip

If software does not have an installer, distribute the software as a file.

Tip

If a ZIP file is registered in a package, the ZIP file is automatically unzipped when the package is distributed to the target computer. If you want to distribute a ZIP file itself, further compress the ZIP file to another ZIP file and then register it in the package.

Tip

Packages used for distributing Widows updates are not displayed in the Packages view.

Related Topics:

2.13.3 Preparation for distribution (ITDM-compatible distribution)

(2) Managing tasks

In the Tasks view of the Distribution (ITDM-compatible) module, you can create and manage tasks. There are the following two types of tasks.

Tasks for package distribution

Tasks for installing software or distributing files. These types of tasks also execute automatic countermeasures for software (including Windows updates).

Tasks for uninstallation

Tasks for uninstalling software.

You can also edit created tasks. When you edit a task, you can change only the distribution destination without changing the distribution package and its schedule, or change the specified package without changing the distribution destination.

It is convenient to copy a task when you want to distribute multiple packages to the same destination or when you want to uninstall multiple software programs from the same computer.

You can also delete completed and unnecessary tasks.

If the destination of a task is one computer and that computer is deleted, the task status becomes completed. If the destination of a task is multiple computers and one of those computers is deleted, only that computer is deleted from the destination. The same operation occurs when a target computer is moved to be under another management server in a multi-server configuration.

The Tasks view of the Distribution (ITDM-compatible) module displays the execution status of tasks. For a task that failed distribution, investigate and correct the cause and then re-execute the task.

Tip

In the following cases, task information will be automatically deleted from the task list:

Tasks executed by the administrator:

- When 30 days have passed after the completion of distribution.

- When the number of devices subject to the task becomes 0.

Tasks executed by automatic countermeasure:

- When 7 days have passed after the completion of distribution.

- When the number of devices subject to the task becomes 0.

- Unset the Automatic Enforcement of Security Policy (Windows Update or Software Use).

Classes of tasks

There are two classes of tasks.

Tasks executed by the administrator

Tasks created in the Tasks view of the Distribution (ITDM-compatible) module by the administrator of JP1/IT Desktop Management 2

Tasks executed by automatic countermeasure

Tasks automatically created based on the settings of automatic countermeasures for security policies. For details, see 2.13.2 Distribution enforced as an automatic countermeasure for security (ITDM-compatible distribution).

Related Topics:

2.13.3 Preparation for distribution (ITDM-compatible distribution)

2.13.2 Distribution enforced as an automatic countermeasure for security (ITDM-compatible distribution)

The distribution function can be used to automatically distribute Windows Updates and mandatory software. It can also be used to automatically uninstall software prohibited by a security policy.

Automatically installing Windows updates

When you set installation of Windows updates in a security policy, you can set installation of Windows updates as an automatic countermeasure.

When you set distribution of Windows updates as an automatic countermeasure, if Windows updates have not been installed on any computers for which the security policy is applied, Windows updates will be automatically distributed to and installed on those computers.

Automatically installing mandatory software

When you set mandatory software in a security policy, you can set installation of the mandatory software as an automatic countermeasure.

When you set installation of mandatory software as an automatic countermeasure, if the mandatory software programs have not been installed on any computers for which the security policy is applied, the software programs will be automatically distributed to and installed on those computers.

However, for Windows Store apps, you can set installation for automated countermeasures but the actual installation will not be performed. If you want to install a Windows Store app, perform the operation individually on the target computer.

Automatically uninstalling prohibited software

When you set prohibited software in a security policy, you can set uninstallation of the software programs as an automatic countermeasure.

When you set uninstallation of software as an automatic countermeasure, if the prohibited software programs have been installed on any computers for which the security policy is applied, the software programs will be automatically uninstalled from those computers.

Note that a software program that does not appear in the Add/Remove Programs window in Windows is not uninstalled. If you want to uninstall such a program, create an uninstallation task in the Tasks view, and execute the task. For execution of an uninstallation task, see 2.13.1 Managing packages and tasks (ITDM-compatible distribution).

For Windows Store apps, you can set uninstallation for automated countermeasures but the actual uninstallation will not be performed. If you want to uninstall a Windows Store app, perform the operation individually on the target computer.

If you set distribution of Windows updates as an automatic countermeasure when setting a security policy, the Windows Update file and task will be automatically created. In this case, the task is displayed in the Tasks view of the Distribution (ITDM-compatible) module. However, the Windows Update file is not displayed in the Packages view. You can check whether the Windows Update file has been registered in the Windows Update view of the Security module.

If you set installation or uninstallation of software, set a package when specifying a security policy. A task is automatically created. In this case, the package and task are displayed in the Packages view and Tasks view of the Distribution (ITDM-compatible) module.

The type of the task created when an automatic countermeasure is set in a security policy is Policy Based Task. A task executed as an automatic countermeasure cannot be edited or copied. Also, when you delete a task, cancel the automatic countermeasure setting, or delete the Software Use setting for the security policy. The task will be automatically deleted depending on the security policy setting.

2.13.3 Preparation for distribution (ITDM-compatible distribution)

The following describes preparation for installing software, distributing files, and uninstalling software. First, common preparation for using the distribution function is described. Next, preparation for individual tasks is described.

Common preparation

Consider the following before using the distribution function.

Distribution destination computers

Determine the distribution-target computers. When you have many target computers, we recommend that you create a custom group for those computers.

Distribution schedule

Determine the distribution schedule. Setting schedules will enable you to perform distribution at night so that the distribution task will not affect business or to perform multiple tasks at the same time. You can also start distribution immediately without setting any schedules.

Automatic startup

You can configure the setting so that if the target computers are turned off, they will be turned on and distribution will be performed. Consider the use of this function when you want to perform distribution at night or to unused computers. Note that, to control computer power, the computers must support AMT or Wake on LAN.

Execution timing

You can set the timing of installing or uninstalling software or storing files after the task is received at a target computer. You can choose one from the following: execute immediately after the task is received, execute when a user logs on, or execute the next time the computer starts. For example, if a running business application may interfere with installation, it is better for you to perform the installation the next time the computer starts.

Messages to be displayed

You can display messages immediately before or after installation or uninstallation of software or distribution of files after a package is distributed. Use messages to notify users of installation or uninstallation, or of notes on the installed software.

Reducing load by distribution

You can reduce network load by restricting the network bandwidth used for distribution. You can also set an upper limit on the amount of data transferred per second when packages are distributed to computers to prevent agent software from occupying too much communication bandwidth with package transfer. For details, see 2.13.7 Reducing load by distribution (ITDM-compatible distribution).

Preparation for installing software

Prepare the software you want to install. You can install software whose installer is an MSI file or EXE file. If multiple files are required for installing software, compress them in a ZIP file. If a ZIP file includes multiple installers, you must check which installer will be used.

Tip

Only the software programs that support silent installation can be installed. Silent installation automatically performs installation on users' computers without displaying windows during installation.

Tip

If software does not have an installer, distribute the software as a file.

Preparation for distributing files

Prepare the file you want to distribute. If you want to distribute multiple files, compress them in a ZIP file. Also, determine the folder to be used for storing the file on the distribution target computers.

Tip

If a ZIP file is registered in a package, the ZIP file will be automatically unzipped when the package is distributed to the target computer. If you want to distribute a ZIP file itself, further compress the ZIP file in another ZIP file and then register it in the package.

Tip

When you determine the folder for storing files, use a folder that is common to the distribution target computers. If the specified folder does not exist on a target computer, the specified folder will be created.

When you distribute a file, you can configure the setting so that a command will be automatically executed on the distribution target computer after the distribution file is received. For example, if you set a command for executing a batch file, you can distribute the batch file and then run that batch file. If you want to use a command, check whether the command can be correctly executed beforehand.

Preparation for uninstalling software

Check whether information about the software program you want to uninstall is displayed in the Software Inventory view of the Inventory module. If it is not displayed, check the execution file name of the software program you want to uninstall.

Tip

If you uninstall a software program that is not displayed in Windows' Programs and Features, the execution file searched for by the software search conditions (or the file name specified when the task was created) will be deleted.

Tip

The software programs that are displayed in Windows' Programs and Features and that were installed by the Windows installer (MSI) can be automatically uninstalled without the uninstallation window being displayed on users' computers (silent uninstallation). For other software programs, the uninstallation window is displayed on the users' computer and the users must uninstall them.

Related Topics:

(1) Conditions for power control

2.13.4 Types of software that can be uninstalled by the distribution function (ITDM-compatible distribution)

The following two types of software can be uninstalled by the distribution function.

Software registered in Programs and Features

These are software programs registered in Windows' Programs and Features.

If an uninstallation command is the Windows Installer, uninstallation is performed with the silent option (/qn) and the option for suppressing restart (ReallySuppress) specified. The return value is judged as follows:

ERROR_SUCCESS(0): Normal termination

ERROR_SUCCESS_REBOOT_INITIATED(1641): Restart is required.

ERROR_SUCCESS_REBOOT_REQUIRED(3010): Restart is required.

Other codes: Abnormal termination

If an uninstallation command is not the Windows Installer, the specified uninstallation command is executed. If the uninstallation command is executed, uninstallation is judged to have finished successfully.

Software registered in the Software Search Conditions view

These are software programs whose information was collected by a search for executable files (such as EXE files) on a computer with the conditions registered in the Software Search Conditions view of the Settings module.

2.13.5 Notes on distribution (ITDM-compatible distribution)

When you use the distribution function to install or uninstall software, set up a test environment for evaluation and verify that software is normally installed and uninstalled with local system account permission. Then, schedule the execution of tasks. This is because the specification and operation of the installer used for the distribution function is determined by the manufacturer of the installer, not by JP1/IT Desktop Management 2.

The following are notes on installing and uninstalling software, and distributing files:

If the file you want to distribute and install is an EXE file, the target computer might not be restarted after installation.

If the file you want to install is an EXE file, the value returned from the installer cannot be judged. So, the result of installation might not be correctly displayed.

When you install software, if an MSI file is started from an EXE file, and the EXE file finishes execution before the result of installation is received, the result of installation might not be correctly displayed.

If immediately after a distribution file is received at a target computer a command further distributes the file to another computer, the result of file distribution might not be correctly displayed.

If the time is different on the management server and an agent-installed computer, power cannot be controlled normally.

If the software you want to uninstall is an MSI file, silent uninstallation is executed. If the software is an EXE file, a dialog box is displayed on the computer. The user must manually uninstall the software as instructed by the dialog box.

Do not specify, as an uninstallation task, software and OSs that cannot be uninstalled from Programs and Features in the Control Panel. Such uninstallation tasks will fail.

Do not uninstall the software and files shown below. If you uninstall them, the OS or JP1/IT Desktop Management 2 might not correctly run.

Software and files that are related to OS operations

JP1/IT Desktop Management 2 and JP1/IT Desktop Management 2 components

Software and files that are related to JP1/IT Desktop Management 2 operations

When some software programs are installed, files and folders may be created with specific user permissions. If such a software program is uninstalled by the distribution function, some of the files and folders might not be deleted. In such a case, the user must delete those files and folders after uninstallation.

When some software programs are installed, shortcut icons may be created on the Desktop. If such a software program is uninstalled by the distribution function, the shortcut icon might not be deleted. In such a case, the user must delete the shortcut icon after uninstallation.

Do not specify a software program as both mandatory software and prohibited software when automated countermeasures are set for installation and uninstallation. If you do so, automatic countermeasures for installation and uninstallation will be alternately performed because the software program is always judged to violate security settings.

If the installer or uninstaller dialog box is displayed, the installer or uninstaller will be automatically terminated forcibly in one hour.

When software is installed or uninstalled by the distribution function, the task is executed with local system account permissions. Also, when a command is executed after a file is distributed by the distribution function, the task is executed with local system account permissions.

When you install an agent or network monitor agent, display the Task Status Details dialog box by clicking the link on the Task Information tab at the bottom of the Task List view. Then, check the result of installation. If the return code displayed in Description is 0, the installation finished successfully.

ITDM-compatible distribution on an agent and job execution cannot occur at the same time on the agent. Therefore, if a job is executed on the agent, the ITDM-compatible distribution status might remain Waiting for execution.

You can register tasks to install or uninstall Windows Store apps, but installation and uninstallation will not actually be performed. To install or uninstall a Windows Store app, you will need to perform installation or installation on each target computer.

For the Citrix XenApp and Microsoft RDS server, when you distribute tasks where When User Logs On is specified as the execution timing, you need to log on to a local console of the Citrix XenApp and Microsoft RDS server.

When package distribution (ITDM-compatible) is performed to a 64-bit OS and if you specify the directories under %windir%\system32 as Expand Folder and Destination Folder, a package is distributed under %windir%\SysWOW64 because of the redirection function of OS. Also, if you specify files under %windir%\system32 as Installation Command and Command After Distribution(ITDM-compatible), the commands are not launched.

2.13.6 Postponing download or installation on a computer to which a package is distributed (ITDM-compatible distribution)

On a computer to which a package is distributed, the package will be downloaded and the software registered in the package will be installed.

The user of the computer can postpone downloading the package or installing the software if needed. Postponing download or installation can prevent the user from suspending ongoing processing during a hasty or important task. You can postpone download and installation again and again.

You can also postpone uninstallation or file distribution as well as installation.

Important

You cannot postpone such operations when logging on to the computer by using the Remote Desktop function.

The following table describes how long download and installation can be postponed.

Operation

How long the operation can be postponed

Download

30 minutes

In 30 minutes, download will automatically restart.

Installation

The user can specify how long it will take until the dialog box for starting installation is redisplayed from the following:

10 minutes

30 minutes

1 hour

2.13.7 Reducing load by distribution (ITDM-compatible distribution)

When large amounts of software and files are distributed from the management server to user computers, the network or computers might become overloaded. To prevent such an overload, you can restrict the network bandwidth used for the distribution function and set an upper limit on the amount of data transferred per second.

Controlling the network bandwidth

If you specify a maximum transfer rate in the setup for JP1/IT Desktop Management 2, the network bandwidth is controlled and data transfers will be limited to that setting. The maximum transfer rate is the maximum value that can be used for sending and receiving data between the management server and agent-installed computers. If the total amount of data sent and received per second reaches the specified upper limit, data transfer is temporarily suspended on the management server. This enables you to transfer data without overloading the network.

You can specify the maximum transfer rate in the Setup dialog box for the management server.

Set an upper limit on the amount of data transferred per second

You can set an upper limit (percentage) on the amount of data transferred per second when packages are distributed to computers. If you set this percentage, computers will adjust the download interval when downloading packages. As a result, network business traffic such as sending or receiving email will be less affected.

You can set the upper limit of the amount of transferred data in Flow Control under Timing of communication with the higher system under Basic settings in the agent configurations. This item is used for maintaining compatibility with the setting in JP1/IT Desktop Management. Do not specify the upper limit of the amount of transferred data, except when you want the same behavior as JP1/IT Desktop Management. If you specify this value, ITDM-compatible distribution might delay so that installation of software or update program and uninstallation of unnecessary software might take a longer time.

2.13.8 Caching distributed packages (ITDM-compatible distribution)

A distributed package is temporarily cached on the distribution target computer. Such a cached package is deleted from the computer only when software installation or file distribution successfully finishes. If such an operation fails, the cached package remains for a specific period of time.

In this case, if you re-execute a task, the package will not be resent and installation or file distribution will be performed using the cached package. Thus, caching distributed packages can reduce the network load.

A package can remain cached for seven days. After the seven days, the cached package will be deleted.

At least 1 GB of free hard disk space is required to cache packages on an agent-installed computer. The maximum capacity of packages that can be cached is 2 GB.

Important

A package cannot be cached in the following cases:

The distributed package has been corrupted.

The free hard disk space on the distribution target computer is less than 1 GB.

The size of the package is more than 2 GB.

2.13.9 Executing a task when a user is logged off (ITDM-compatible distribution)

You can distribute or install a package even if the user of the distribution target computer is logged off. You can also turn on the distribution target computer, and then turn it off after distribution.

The following table describes which operations can or cannot be executed while a task is executed when the user on an agent-installed computer is logged off.

Operation

Whether the operation can be executed

Distributing a package

Y #

Installation

Uninstallation

Turning on and off of the distribution target computer

Restarting the distribution target computer

Displaying messages immediately before and after executing a task

N

Postponing download

Postponing installation

Legend: Y: Can be executed. N: Cannot be executed.

#: Uninstallation using an EXE file cannot be performed when the user is not logged on.

Related Topics:

2.13.10 Power control by the distribution function (ITDM-compatible distribution)

2.13.10 Power control by the distribution function (ITDM-compatible distribution)

If you enable automatic startup of distribution target computers when setting a package distribution task, you will be able to turn on the distribution target computers and distribute the package. This enables you to distribute packages even at night when no one is using computers.

If you want to turn on the distribution target computers for distribution, select the If target PC is OFF, turn ON power automatically. check box when you create a task.

Tip

If you select the option After executing the task, shut down only the computer that started automatically. while creating a task, and also, if the computer is turned on within one hour after the task was executed, a dialog box appears. The user can select for the computer to be automatically turned off after distribution finishes.

Important

Distribution target computers must support AMT or Wake on LAN if you want to control the power of the computers.

Important

If you select the If target PC is OFF, turn ON power automatically. check box and the distribution target computer is already on, a dialog box announcing that shutdown or restart will be performed after the package is distributed appears on the target computer's window.

Whether "If target PC is OFF, turn ON power automatically." is selected or not

Whether restart of the computer is necessary or not after distribution

How the computer is started

Timing of starting the computer and executing the task

Computer's behavior#

Selected (After executing the task, shut down only the computer that started automatically. is selected.)

Unnecessary

The computer is already running.

--

Downloads the package.

The user must start the computer.

The computer is started before the task is executed.

Downloads the package, and displays a dialog box announcing shutdown.

The task is executed, and then the computer is started within an hour.

The task is executed, and after more than one hour passes, the computer is started.

Downloads the package.

The computer is automatically started when the task is executed.

The computer is started before the task is executed.

Downloads the package, and displays a dialog box announcing shutdown.

The task is executed, and then the computer is started within an hour.

The task is executed, and after more than one hour passes, the computer is started.

Downloads the package.

The user must restart the computer.

The computer is started before the task is executed.

Downloads the package, and displays a dialog box announcing shutdown.

The task is executed, and then the computer is started within an hour.

The task is executed, and after more than one hour passes, the computer is started.

Downloads the package.

Necessary

The computer is already running.

--

Downloads the package, and displays a dialog box announcing restart.

The user must start the computer.

The computer is started before the task is executed.

Downloads the package, and displays a dialog box announcing shutdown.

The task is executed, and then the computer is started within an hour.

The task is executed, and after more than one hour passes, the computer is started.

Downloads the package.

The computer is automatically started when the task is executed.

The computer is started before the task is executed.

Downloads the package, and displays a dialog box announcing shutdown.

The task is executed, and then the computer is started within an hour.

The task is executed, and after more than one hour passes, the computer is started.

Downloads the package, and displays a dialog box announcing restart.

The user must restart the computer.

The computer is started before the task is executed.

Downloads the package, and displays a dialog box announcing shutdown.

The task is executed, and then the computer is started within an hour.

The task is executed, and after more than one hour passes, the computer is started.

Downloads the package.

--

The computer is already running.

--

Downloads the package, and displays a dialog box announcing shutdown.

The user must start the computer.

The computer is automatically started when the task is executed.

The user must restart the computer.

Selected (After executing the task, shut down all target computers. is selected.)

--

The computer is already running.

--

Downloads the package, and displays a dialog box announcing shutdown.

The user must start the computer.

The computer is automatically started when the task is executed.

The user must restart the computer.

Not selected

Unnecessary

The computer is already running.

--

Downloads the package.

The user must start the computer.

--

The user must restart the computer.

--

Necessary

The computer is already running.

--

Downloads the package, and displays a dialog box announcing restart.

The user must start the computer.

--

The user must restart the computer.

--

Legend: --: Not applicable.

#: The behavior might be different if the times on the management server and the distribution target computer are different.

2.13.11 Judging the result of software installation executed by the distribution function (ITDM-compatible distribution)

Whether software installation executed by the distribution function was successful is judged based on the execution result of the installation command set for the package. The following shows how the result is judged for different formats of files registered in the package:

For MSI files

The execution result of installation is judged depending on the value returned by the Windows Installer. The return value is judged as follows:

ERROR_SUCCESS(0): Normal termination

ERROR_SUCCESS_REBOOT_INITIATED(1641): Restart is required.

ERROR_SUCCESS_REBOOT_REQUIRED(3010): Restart is required.

Other codes: Abnormal termination

For files with other formats

If the installation command set for the package is executed, installation is judged to have finished successfully.

Note that if startup of the installation command fails or if a timeout occurs during startup of the installation command or of the started installer, installation is judged to have failed.

2.14 Collecting files by using Remote Install Manager

JP1/IT Desktop Management 2 can collect files stored on the managed computers in a single operation. The collected files are stored in the management server. This feature is called remote collection. This section provides an overview of file collection. For details and procedures, see the JP1/IT Desktop Management 2 Distribution Function Administration Guide.

The remote collection feature can be used for the following operations:

Collect operation data required for the administrators' job in a single operation.

Help troubleshooting by collecting and analyzing log information or error information of the software used on the user's computer.

Important

The collection of files by using Remote Install Manager is not possible for API-controlled devices.

The following figure shows an overview of remote collection:

To perform remote collection, create a Collect files from agent job by using Remote Install Manager. The collected target files are compressed or archived, and then transferred to the management server. To unarchive compressed or archived files, use Unarchiver, which is a component of JP1/IT Desktop Management 2 - Manager.

For agents for Mac, you cannot collect files by using Remote Install Manager.

Providing a relay system can reduce the load on the network caused by remote collection.

2.15 Displaying events

If something occurs that needs immediate countermeasures while JP1/IT Desktop Management 2 is running, it will be output as an event. The results of processing various functions are also output. The administrator can understand what happened while JP1/IT Desktop Management 2 was running by checking events.

2.15.1 Events to be output

An event is output if something occurs (for example, a device is detected, an asset is registered, or judgment based on a security policy is performed) while JP1/IT Desktop Management 2 is running. You can check the output event in Events module.

Events are divided into three severities depending on the details.

(Critical)

Events that require immediate action. Check the details of the event, and take action immediately.

(Warning)

Events that require a response but not immediately. Check the details of the event, and take action as necessary.

(Information)

Events regarding the results of system processing. No actions are required.

Some events require immediate action. Check Critical events first and then Warning events. Determine the cause referring to the error message, and take appropriate actions. You can check the total number of events and the number of individual types of events on the Not Ack Event Summary panel of the Home module. You can also check the number of unconfirmed events in Summary Reports.

You can set for the administrator to be notified of events when they occur.

Tip

The maximum number of events to be displayed is determined by the formula Number of managed computers x 250 + 10,000. If the number of events exceeds this value, older evens will be overwritten. Back up past events to save them.

Related Topics:

2.15.2 Event types

2.15.2 Event types

The following are types of events to be output:

Inventory

Events regarding device management, such as addition and deletion of device inventory or software inventory, or addition and deletion of computer accounts.

Security

Events regarding security management, such as change and assignment of security policies, judgment results for security policies, results of actions, or suppression of startup of software.

Assets

Events regarding asset management, such as registration of assets, change of asset statuses, or addition and deletion of software licenses.

Distribution (ITDM-compatible)

Events regarding distribution, such as software installation or uninstallation, or file distribution.

Settings

Events regarding settings, such as device detection, addition of management targets, or agent deployment.

Suspicious Operations

Events regarding suspicious operations, such as detection of emails with attached files, detection of file uploads to Web servers or FTP servers, or detection of files being copied or moved to external media.

Relay

Events regarding relaying data among management servers. This event type is only output in multi-server configuration.

API

Events regarding the API.

Error

Events regarding errors that occurred in various functions.

2.15.3 Event format

Field

Description

Status

This field shows whether the event was checked. Clicking the field changes the status.

Not Ack

Ack

Severity

This field shows the severity of the event. One of the following is displayed:

Critical

The event requires immediate action.

Warning

The event requires action but not immediately.

Information

The event is regarding the results of system processing. No actions are required.

Registered Date/Time

The date and time the event was registered in the management server is displayed.

Type

This field shows the event type. One of the following is displayed:

Inventory

Security

Assets

Distribution (ITDM-compatible)

Settings

Suspicious Operations

Relay

Error

Event #

The ID of the event message is displayed.

Source

This field shows information that identifies the target of the event. For example, the device on which the event occurred, or the security policy for which the event occurred is displayed.

Description

Detailed information about the event is displayed.

2.15.4 Checking events on the JP1/IM event console

When JP1/IM is linked, you can monitor error events that occur on managed computers (except Mac OS) and major events that require judgment by the system administrator on the JP1/IM event console.

JP1/IT Desktop Management 2 can use a JP1/Base function to issue JP1 events when errors occur on managed computers (except Mac OS). By linking with JP1/IM, you can use the JP1/IM event console to monitor recent JP1 events or monitor programs of other JP1 products.

The following figure shows the operation flow when an event is displayed on the JP1/IM event console.

If an error occurs in JP1/IT Desktop Management 2 - Manager, an event is sent to JP1/IT Desktop Management 2 - Manager.

The event received at JP1/IT Desktop Management 2 - Manager is registered as a JP1 event in the JP1/Base event database.

The JP1 event registered in the event database is forwarded to the JP1/IM server on which JP1/IM - Manager is running.

The JP1 event forwarded to the JP1/IM server is registered in the JP1/IM integrated management database.

JP1/IM - Manager acquires the JP1 event from the integrated management database.

The acquired JP1 event is displayed on the JP1/IM event console.

For events that can be output to the JP1/IM event console, see the JP1/IT Desktop Management 2 Administration Guide.

2.16 Displaying reports

JP1/IT Desktop Management 2's report function enables you to calculate managed information depending on your purpose. The administrator can refer to reports as necessary for various tasks, or print reports when reporting the current status.

There are the following five types of reports:

Summary Reports

You can gain an overview of managed information using a graph or list. You can use these types of reports to check the current status. You can also use them to check future plans to help schedule tasks.

Security Diagnosis Reports

You can check the total security assessment and assessments for individual categories in graphs. The assessment levels and points for individual groups are also displayed in lists, so you can check the security status for each group. You can use these types of reports when reporting overall security conditions.

Security Detail Reports

You can check detailed security status in graphs or lists. You can use these types of reports as a start point for security measures. For example, you can identify problematic computers or check the details of problems.

Inventory Detail Reports

You can check the number of managed devices or the power saving settings of individual computers. You can use these types of reports to check the details about the number of devices in a specific department or to understand the status of Green IT efforts.

Asset Detail Reports

You can check transitions in the number of managed hardware assets, transitions in contract costs, and the status of software licenses. You can use these types of reports to understand the trends in assets and costs, or to check the usage status of software licenses.

2.16.1 Viewing reports

In the Reports module, you can view 20 types of reports depending on your purpose. You can print reports or output them to CSV files. In a multi-server configuration, the total of the results of information owned by the local server is output to the report. The following table lists the report types that can be displayed.

Category

Type

Applicable to a target group#

Summary Reports

Daily Summary

N

Weekly Summary

N

Monthly Summary

N

Security Diagnosis Reports

Current Diagnosis

Y

Timeframe Diagnosis

Y

Security Detail Reports

Violation Level Status

Y

Windows Update Status

Y

Antivirus Software Status

Y

Mandatory Software Status

Y

Unauthorized Software Status

Y

Security Settings Status

Y

Other Access Restrictions

N

User Activity

N

Inventory Detail Reports

Device Management Status

Y

Green IT (Power Saving Settings)

Y

Asset Detail Reports

Hardware Assets

Y

All Assets Cost

Y

Hardware Assets Cost

Y

Software License Cost

Y

Other Cost

Y

Software (License Violation)

Y

Software (Surplus License)

Y

Legend: Y: Applicable. N: Not applicable.

#: User-defined groups cannot be the target of a report.

The following is an overview of the above reports and how you can use them:

Summary Reports

Use summary reports to gain an overview of managed information. Check the current status and future plans to schedule future task plans.

Daily Summary

Daily summaries let you check daily information, such as the status of events, the number of assets you plan to change the status of, the status of software licenses, and the status of distribution jobs. The current free database capacity is also displayed. Use these reports to check the current status and future plans, and to help you schedule daily tasks.

Weekly Summary

Weekly summaries let you check weekly information, such as the status of events, the number of assets you plan to change the status of, the status of software licenses, and the status of distribution jobs. For the status of events, transitions in the number of events through a week are displayed. Use these reports to check the current status and future plans, and to help you schedule weekly tasks.

Monthly Summary

Monthly summaries let you check monthly information, such as the status of events, the number of assets you plan to change the status of, the status of software licenses, and the status of distribution jobs. For the status of events, transitions in the number of events through a month are displayed. The results and plans related to the costs for assets are also displayed. Use these reports to check the current status and future plans, and to help you schedule monthly tasks.

Security Diagnosis Reports

Use security diagnosis reports to check the total security assessment level and category assessment levels.

Current Diagnosis

Displays the results of the total assessment of the current security status of computers. Use these reports to check the security status of all managed computers and to consider countermeasures for the items with low security status.

Timeframe Diagnosis

Displays the results of the total assessment of the computers' security status for a specified period. Use these reports to check the transitions of the results of diagnosis and to understand security status trends.

Note

The number of devices displayed in the Comments column is the TOTAL number of problematic computers that were tallied during the indicated timeframe.

Security Detail Reports

Use security detail reports to check the details of security status.

Violation Level Status

Displays the status of violation levels and the security status of individual groups. Use these reports to check the violation levels of computers and to consider and strengthen security measures.

Windows Update Status

Displays the number of computers on which Windows updates set in the security policy have not been installed and the status of individual groups. Use these reports to target for updating all computers on which relevant Windows updates have not been installed.

Antivirus Software Status

Displays the number of computers to which antivirus software has not been applied and the status of individual groups. Use these reports to help check and update antivirus software.

Mandatory Software Status

Displays the number of computers on which the mandatory software programs set in the security policy have not been installed and the status of individual groups. Use these reports to target installation requests for mandatory software.

Unauthorized Software Status

Displays the number of computers on which the prohibited software programs set in the security policy have been installed and the status of individual groups. Use these reports to target uninstallation requests for prohibited software.

Security Settings Status

Displays the number of computers on which illegal accesses might occur, the number of computers that have problems related to user-defined security settings, and the status of individual groups. Use these reports to check which security measures are problematic and to help enforce appropriate security measures on individual computers.

Other Access Restrictions

Displays information about computers on which printing is restricted, startup of software is restricted, or use of devices is restricted. The computers are displayed in the order of highest to lowest number of restrictions. Use these reports to check for users who have many restrictions applied to them, and to give them advice.

User Activity

Displays the printing activity of computers. Also displays which computers have used USB devices. The computers are listed in the order of the number of uses. Use these reports to investigate the computers from which information might have been illegally moved by printing or by the use of USB devices.

In a multi-server configuration, when report the operation log to a higher-level system is enabled on the lower management relay server, the reports include operation logs and suspicious operations on computers under the lower management relay server.

Note

When you specify task allocation (the administration scope of departments), for departments that have devices necessary to be managed, the operation to assign administrators (users) is assumed. Calculated information of security reports is calculated for each device. Because departments are specified in task allocation (the administration scope of departments), the calculation of security reports is displayed for each department. The information displayed as security reports is limited to the departments that have information calculated for reports, and the information is not displayed if there is not the calculated information of security reports of departments.

Inventory Detail Reports

Use inventory detail reports to check the number of managed devices and the status of the power saving settings on individual computers.

In a multi-server configuration, the number of devices managed by the management relay server under the local server is included in the report.

Device Management Status

Displays the number of managed devices and the increase and decrease of the number of devices. Use these reports to understand the increase and decrease of devices for each OS or to check the details of the devices in a specific department.

Green IT (Power Saving Settings)

Based on the status of the power saving settings on the managed computers, Green IT reports display the difference from the ideal energy consumption. Use these reports to reduce the power consumption of computers or to understand the status of the Green IT efforts.

Asset Detail Reports

Use asset detail reports to check the transitions of the number of managed hardware assets, the transitions of contract costs, and the status of software licenses.

Hardware Assets

Displays the transitions of the number of managed hardware assets for individual device types. Use these reports to understand trends in the transitions of the number of hardware assets through a year or to check the percentage of each hardware asset device type.

All Assets Cost

Displays the total costs of Hardware Assets Cost, Software License Cost, and Other Cost. Use the report to check the transitions of the operational costs.

Hardware Assets Cost

Displays the transitions of the costs for hardware assets through a year. Use these reports to understand the trends in the transitions of contract costs through a year or to judge whether contract costs are appropriate. Changes made to the past contract costs are immediately applied and displayed.#

Software License Cost

Displays the transitions of the costs for software licenses through a year. Use these reports to understand the trends in the transitions of contract costs through a year or to judge whether contract costs are appropriate. Changes made to the past contract costs are immediately applied and displayed.#

Other Cost

Displays the transitions of the costs for other than hardware assets and software licenses through a year. Use these reports to understand the trends in the transitions of contract costs through a year or to judge whether contract costs are appropriate. Changes made to the past contract costs are immediately applied and displayed.

Software (License Violation)

Displays information about the software programs for which there are insufficient licenses in the order of the number of insufficient licenses. The software programs listed in these of reports might be violating licenses. Use these reports to check the usage statuses of software licenses and to consider countermeasures, such as purchasing additional licenses.

Software (Surplus License)

Displays information about unused software licenses in the order of the number of excess licenses. Use these reports to confirm license requirements before purchasing software licenses.

#: You can also configure the report to always display the total costs as of the previous month even when changes are made to the past contract costs.

2.16.2 Calculation of the assessment level in Security Diagnosis Reports

Security Diagnosis Reports display the results of calculating, analyzing, and diagnosing the outcome of judging the security status of devices. In addition to the total security assessment level, it displays the assessment levels for individual categories (such as the Antivirus Software status and the Security Settings status) and the transitions of assessment levels.

Security Diagnosis Reports display assessments in five levels (A to E). Level A is the safest, and Level E is the most unsafe. An assessment level is determined by the points for individual devices, which are based on the security judgment results. If all security judgment items are in Safe status for a device, the device will have 100 points. If some judgment items are not in Safe status, points will be deducted based on the judgment results for the security judgment items. Even if the average number of points is high, the assessment level will become low if one or more computers are in Critical status during the judgment period.

In Security Diagnosis Reports, an assessment level displayed in the Category Assessment Status area will become low if one or more computers are in Critical status, to let you consider countermeasures for items with low security status. On the other hand, an assessment level displayed in the Assessment and # of Target Trend is determined based on the average number of points for each category, to let you understand security status trends. For this reason, the assessment levels might be different between Category Assessment Status and Assessment and # of Target Trend.

The following table lists the points that are to be deducted for individual violation levels.

Violation level

Deduction points

Critical

25

Important

16

Warning

6

Safe

0

Note that points are not deducted when a judgment error occurs, judgment items are missing, or there is not enough information for security judgment.

The following table lists the criteria for the total security assessment level.

Assessment level

Average points

Minimum points

Violation level in the judgment results

Category assessment level

A

90 to 100

90 to 100

No Critical and Important levels

Level A only

B

80 to 89

80 to 89

No Critical levels

Level A and B only

C

65 to 79

50 to 79

No Critical levels

Level A to D only

D

50 to 64

Not defined.

Not defined.

Not defined.

E

0 to 49

Not defined.

Not defined.

Not defined.

For example, assume that the average number of points is 95 (which corresponds to level A), the minimum number of points is 87 (which corresponds to level B), the violation level in the judgment results is "No Critical and Important levels" (which corresponds to level A), and the category assessment level is "Level A and B only" (which corresponds to level B). In this case, the total security assessment level becomes level B. Thus, the lowest assessment level among the above four items ("Average points", "Minimum points", "Violation level in the judgment results", and "Category assessment level") will become the total security assessment level.

The following table lists the criteria of the category assessment levels.

Assessment level

Average points

Minimum points

Violation level in the judgment results

A

90 to 100

90 to 100

No Critical and Important levels

B

80 to 89

80 to 89

No Critical levels

C

65 to 79

50 to 79

No Critical levels

D

50 to 64

Not defined.

Not defined.

E

0 to 49

Not defined.

Not defined.

For example, assume that the average number of points is 95 (which corresponds to level A), the minimum number of points is 87 (which corresponds to level B), and the violation level in the judgment results is "No Critical and Important levels" (which corresponds to level A). In this case, the category assessment level becomes level B. Thus, the lowest assessment level among the above three items ("Average points", "Minimum points", and "Violation level in the judgment results") will become the category assessment level.

2.16.3 Criteria for judging whether Green IT has been applied

You can use the Green IT (Power Saving Settings) report to check whether the power saving setting on a computer has been applied. Whether the power saving setting on a computer is applied is judged based on comparison of the power saving setting collected from the computer and the sample PC setting. The following table describes the relationship between the statuses of the power saving settings on a computer and the judgment results.

Status

Judgment

Applicable

power-saving-setting-on-a-computer ≤ judgment-reference-value

(Excluding when the power saving setting on a computer is None)

Not Applicable

power-saving-setting-on-a-computer > judgment-reference-value or the power saving settings on a computer is None.

Unknown

The judgment reference value for the power saving setting has been set, but the power saving setting on a computer cannot be acquired.

Out of Target

The judgment reference value has not been set.

2.16.4 Calculation of ideal energy consumption (theoretical value) and energy consumption (theoretical value)

The ideal energy consumption (theoretical value) is calculated based on the reference values for power saving that are set in the Set Green IT Property dialog box. The energy consumption (theoretical value) is calculated based on the settings on individual computers.

For the operating time of a computer, the values for the sample settings in the Set Green IT Property dialog box are used for both the ideal energy consumption (theoretical value) and energy consumption (theoretical value).

The power consumption per hour is calculated as the total value of the combination of power saving settings shown in the following table.

No.

Status of the monitor

Status of the computer

Power consumption per hour (W)

1

Usual operation# (30)

Usual operation# (39)

69

2

Turn Off Hard Disks (35)

65

3

System Standby (3)

33

4

System Hibernate (0)

30

5

Turn Off Monitor (0)

Usual operation (39)

39

6

Turn Off Hard Disks (35)

35

7

System Standby (3)

3

8

System Hibernate (0)

0

Note: In the above table, the numbers enclosed by parentheses indicate power consumption per hour (unit: W). Note that a computer can only be in one of the above statuses at a time. If multiple patterns of power saving settings are operating at the same time, the power saving settings with lower power consumption is selected.

#: Power saving settings are not operating.

Calculation of ideal energy consumption (theoretical value)

The ideal energy consumption (theoretical value) is the value when the judgment criteria for power saving settings that is set in the Set Green IT Property dialog box is applied to the computers and the computers run as defined in the sample settings.

The following describes how to calculate the ideal energy consumption (theoretical value) with the following conditions:

Number of managed computers: 100

Reference values for the power saving settings in the Set Green IT Property dialog box (default):

Turn Off Monitor (AC): Within 5 minutes

Hard Disk Turn Off Time (AC): Within 30 minutes

System Standby (AC): Within 1 hour

Sample settings in the Set Green IT Property dialog box (default):

Operating time for a computer (per day): 8 hours

Time a computer is not operated: 60 minutes x 1 and 10 minutes x 6

The ideal energy consumption (theoretical value) is calculated for the time computers are operated and for the time computers are not operated separately. These calculations are based on the values in the above table.

Time a computer is operated

According to the sample settings, the time a computer is not operated (60 minutes x 1 + 10 minutes x 6) is excluded from the operating time per day (8 hours). In this example, the operating time becomes as follows:

8 hours - 2 hours = 6 hours

When a computer is operated, power saving settings are not operating. So, No.1 in the above table is applied. The calculation formula is as follows:

69 x 6 hours = 414 (Wh)

Time a computer is not operated

There are two types ("60 minutes x 1" and "10 minutes x 6") of energy consumption according to the sample settings.

Energy consumption for "60 minutes x 1"

For Monitor Turn Off Time, 5 minutes is set. So, the status of No.1 in the above table continues for 5 minutes, and then the monitor is turned off. For Hard Disk Turn Off Time, 30 minutes is set. So, the status of No. 5 in the above table continues for 25 minutes, and then the power of the hard disk is turned off. For System Standby, 1 hour is set. So, the remaining 30 minutes will be in the status of No.6 in the above table. Thus, the calculation formula is as follows:

(69 x 5 minutes / 60 minutes) + (39 x 25 minutes / 60 minutes) + (35 x 30minutes / 60 minutes) = 39.5 (Wh)

Energy consumption for "10 minutes x 6"

This type of energy consumption is also calculated in the same way as the above type of energy consumption (60 minutes x 1). The status of No.1 in the above table continues for 5 minutes, and then the status of No.5 in the above table continues for 5 minutes. These status changes repeat 6 times. Thus, the calculation formula is as follows:

{(69 x minutes / 60 minutes) + (39 x 5 minutes / 60 minutes)} x 6 = 54 (Wh)

Calculation formula for ideal energy consumption (theoretical value)

The ideal energy consumption (theoretical value) results from multiplying the total energy consumption for the time a computer is operated and for the time a computer is not operated, by the number of computers. Thus, the calculation formula is as follows:

(414 + 39.5 + 54) x 100 = 50,750 (Wh)

Calculation of energy consumption (theoretical value)

The energy consumption (theoretical value) is the value when computers operate following the power saving settings on individual computers and the sample settings (for computers' usage).

The energy consumption (theoretical value) can be calculated in the same way as the ideal energy consumption (theoretical value). The following shows the number of computers, an example setting, and calculation of energy consumption (theoretical value) for that setting:

Number of managed computers: 100

Computer settings:

Turn Off Monitor (AC): 10 minutes

Turn Off Hard Disks (AC): 30 minutes

System Standby (AC): 90 minutes

This example assumes that all computers have the same settings.

Sample settings in the Set Green IT Property dialog box (Example)

Operating time for a computer (per day): 8 hours

Time a computer is not operated: 60 minutes x 1 and 10 minutes x 6

Calculation formula for energy consumption (theoretical value)

Energy consumption per computer (theoretical value): (69 x 6 hours) + (69 x 10 minutes / 60 minutes) + (39 x 20 minutes / 60 minutes) + (35 x 60 minutes / 60 minutes) +{(69 x 10 minutes / 60) x 6} = 542.5 (Wh)

Energy consumption for 100 computers (theoretical value): 542.5 x 100 = 54,250 (Wh)

Thus, energy consumption values for individual computers are calculated based on the settings, and totaled as the energy consumption (theoretical value). Note that the energy consumption (theoretical value) is calculated based on only the computers whose power saving setting information can be acquired.

2.16.5 Calculation schedules for reports

When you display reports, the results of calculations executed according to the calculation schedule or the current calculation results are displayed. Calculation schedules differ depending on the report type. Also, the duration for calculating a report and for storing data differ depending on the report type. The following table lists the data calculation schedule, report duration, and storage duration for individual reports.

Reports

Calculation target

Schedule

Report duration

Storage duration

Whether a schedule can be set

Summary Reports

Daily Summary

All information items

Every day at 6:00

For the previous day

For 7 days

N

Weekly Summary

On the start day of every week after calculation for Daily Summary finishes

For the previous week

For 5 weeks

Y

Monthly Summary

On the start day of every month after calculation for Daily Summary finishes

For the previous month

For 3 months

Y

Security Diagnosis Reports

Current Diagnosis

Devices (by group or by security policy)

On-demand#1

At the execution time

Only the most recent

N

Every day after the regular judgment finishes (at 0:00 by default)

At the calculation time

Y#2

Timeframe Diagnosis

Weekly

Devices (by group or by security policy)

Every day at 1:00

For this week (daily)

For 6 weeks

Y

Monthly

For this month (daily)

For 3 months

Y

Quarterly

On the start day of every month (after daily calculation finishes)

For this quarter (monthly)

For 5 years#3

Y

Half Yearly

For this half-year (monthly)

For 5 years#3

Y

Yearly

For this year (monthly)

For 5 years#3

Y

Security Detail Reports

Violation Level Status

Devices (by group or by security policy)

On-demand#1

At the execution time

Only the most recent

N

Every day at 1:10

At the calculation time

N

On the start day of every month at 0:30

For the previous month

For 1 year

Y

Windows Update Status

Antivirus Software Status

Mandatory Software Status

Unauthorized Software Status

Security Settings Status

Devices (by group or by security policy)

On-demand#1

At the execution time

Only the most recent

N

Every day at 1:10

At the calculation time

N

Other Access Restrictions

Events (by device or by user account)

When an event occurs

At the calculation time

--

N

User Activity

Inventory Detail Reports

Device Management Status

Devices (by group)

On-demand#1

At the execution time

Only the most recent

N

Everyday at 0:40

At the calculation time

N

On the start day of every month at 0:30

For the previous month

For 1 year

Y

Green IT (Power Saving Settings)

Devices (by group)

On-demand#1

At the execution time

Only the most recent

N

Every day at 0:40

At the calculation time

N

On the start day of every month at 0:30

For the previous month

For 1 year

Y

Asset Detail Reports

Hardware Assets

Hardware assets (by group)

On-demand#1

At the execution time

Only the most recent

N

Every day at 0:10

At the calculation time

N

On the start day of every month at 0:00

For the previous month

For 5 years#3

Y

All Assets Cost

Contract (by contract)

On the start day of every month at 0:00#6

For the previous month

For 5 years#3

Y

When a report is displayed#6

At the time a report is displayed

--

N

Hardware Assets Cost

Contract (by contract)

On the start day of every month at 0:00#4

For the previous month

For 5 years#3

Y

When a report is displayed#5

At the time a report is displayed

--

N

Software License Cost

Contract (by contract)

On the start day of every month at 0:00#4

For the previous month

For 5 years#3

Y

When a report is displayed#5

At the time a report is displayed

--

N

Other Cost

Contract (by contract)

When a report is displayed#5

At the time a report is displayed

--

N

Software (License Violation)

Managed software (by managed software program)

When a report is displayed

At the time a report is displayed

--

N

Software (Surplus License)

Legend: Y: Can be set. N: Cannot be set. --: Not applicable.

#1: The current data is calculated if you click the Calculate button displayed in a report.

#2: The calculation schedule is changed if you set the schedule in the Security Schedule view (under Security) of the Settings module.

#3: You can set this value in the Duration and Start Date view (under Reports) of the Settings module.

#4: This calculation schedule is applicable when you upgrade JP1/IT Desktop Management 2 from a version earlier than 12-10 to 12-10 or later.

#5: This calculation schedule is applicable when JP1/IT Desktop Management 2 version 12-10 or later is installed for the first time.

#6: This calculation schedule is applicable when JP1/IT Desktop Management 2 from a version earlier than 12-60 to 12-60 or later.

Important

When there is data that has already been calculated, if you change the setting of the start date, a date redundantly calculated for multiple periods or a date that is not calculated for any period might occur. Therefore, after you change the start date, only use the data calculated after the change.

2.16.6 Printing reports

The reports displayed in the Reports module can be printed in A4 size almost as displayed. However, buttons and scroll bars that are not directly related to the contents of the report are not printed. A report with many display items such as Summary Reports is printed in several pages depending on the display contents. Also, a page number is printed at the bottom center of each page.

Important

The color of each item in the legend might not be displayed when you print out reports.

2.16.7 Deleting reports

The data in the following reports increases through the period of using the reports because calculated data is accumulated. Deleting unnecessary reports can reduce disk consumption.

Security Diagnosis Reports - Monthly assessment

Asset Detail Reports - Hardware Assets

Asset Detail Reports - All Assets Cost

Asset Detail Reports - Hardware Assets Cost

Asset Detail Reports - Software License Cost

You can delete a report by changing its storage duration. If you shorten the storage duration of a report so that the storage duration has expired, the report will be deleted at the next regular calculation time (once a day). For example, if you change the storage duration of reports from two years to one year, the reports created one year and three month ago will be deleted at the next regular calculation time.

You can set the storage duration of reports in the Duration and Start Date view (under Reports) of the Settings module. The default storage duration is five years.

2.17 Using filters

You can use filters to narrow the conditions for the information to be displayed.

There are two types of filters: simple filter and detailed filter.

simple filter

From the provided filter items, you can select the conditions for filtering information. From the pull-down menu displayed above the list, you can select the conditions (filter items) for information to be displayed. Thus, you can quickly filter information.

detailed filter

You can set a combination of multiple detailed conditions. Use detailed filters when you cannot filter the target information as desired by using simple filters.

Detailed filters include the filter items provided by JP1/IT Desktop Management 2. If you select a filter displayed under Filter in the menu area, you can apply the filter to the displayed view.

In the above figure, the PC filter is applied to the list displayed in the Department List view (under Hardware Assets) of the Assets module. The selected filter and the view it is applied to are shown in blue in the menu area.

You can also add a detailed filter that specifies optional conditions. Place the mouse cursor on Filter in the menu area, and then click . If you enter a filter name, the Edit Filter Conditions dialog box is displayed, and you will be able to set various conditions depending on your purpose. For example, to filter the computers to be replaced, you can set the conditions as follows: set 3 years ago or older for Registered Date/Time, and Windows 7 for OS.

Tip

Save frequently used filter conditions to avoid the task of specifying conditions every time. You can select saved filter conditions in the menu area to apply them to a list.

Tip

If you use All Hardware Asset Items when you set filter conditions for asset information, you can display asset information that includes any character string you specify.

Tip

"contains either of" or "contains any of" can be used in filter conditions for searching.

Any words to be searched for can be list in the search term, separated by a half-width space. In addition, if the search term is half-width space or contains half-width space, the search term should be enclosed in double quotation marks.

Note that you can also display the Edit Filter Conditions dialog box by clicking the button.

If you apply filters, Filter: OFF displayed above the list changes to Filter: ON, the green indicator lights, and the number of filtered computers (in the above figure) is displayed.

To cancel the filter, click the button. The display changes to Filter: OFF and the conditions are cancelled.

Tip

You can also export or import detailed filter conditions by executing commands.

Related Topics:

2.17.1 Filters provided by JP1/IT Desktop Management 2

2.17.1 Filters provided by JP1/IT Desktop Management 2

The following describes the conditions set for the filters provided by JP1/IT Desktop Management 2.

Filters in the Security module

The following table describes the filter conditions displayed in the menu area of the Security module.

Filters in the Computer Security Status view

Filter name

Conditions

Violation Level

violation-level, contains neither of, and Out of target, Safe

Filters in the Windows Update view

Filter name

Conditions

Recent Updates (last 30 days)

Release Date, or later, month(s), 1, and before

Release Date, or before, and Today

Filters in the Assets module

The following table describes the filter conditions displayed in the menu area of the Assets module.

Filters in the Hardware Assets view

Filter name

Conditions

Unconfirmed Asset

Asset Status, contains any of, and Unconfirmed

PC

Asset Status, contains neither of, and Unconfirmed, Disposed

Device Type, contains any of, and PC

Server

Asset Status, contains neither of, and Unconfirmed, Disposed

Device Type, contains any of, and Server

Storage

Asset Status, contains neither of, and Unconfirmed, Disposed

Device Type, contains any of, and Storage

Peripheral Device

Asset Status, contains neither of, and Unconfirmed, Disposed

Device Type, contains any of, and Peripheral Device

USB Device

Asset Status, contains neither of, and Unconfirmed, Disposed

Device Type, contains any of, and USB Device

Network Device

Asset Status, contains neither of, and Unconfirmed, Disposed

Device Type, contains any of, and Network Device

Printer

Asset Status, contains neither of, and Unconfirmed, Disposed

Device Type, contains any of, and Printer

Smart Device

Asset Status, contains neither of, and Unconfirmed, Disposed

Device Type, contains any of, and Smart Device

Display

Asset Status, contains neither of, and Unconfirmed, Disposed

Device Type, contains any of, and Display

Registered Assets (last 6 months)

Asset Status, contains neither of, and Unconfirmed, Disposed

Registered Date/Time, or after, month, 6, and before

Registered Date/Time, or before, and Today

Untracked Assets (last 6 months)

Asset Status, contains neither of, and Unconfirmed, Disposed

Tracked Date, before, month, 6, and before

Unconfirmed USB Device

Asset Status, contains any of, and Unconfirmed

Device Type, contains any of, and USB Device

Filters in the Software Licenses view

Filter name

Conditions

Registered Licenses (last 6 months)

License Status, contains neither of, and Disposed

Registered Date/Time, or after, month, 6, and before

Registered Date/Time, or before, and Today

Untracked Licenses (last 6 months)

License Status, contains neither of, and Disposed

Tracked Date, before, month, 6, and before

Filters in the Managed Software view

Filter name

Conditions

License Violation Software

License Type, contains any of, and Install License

Remaining License Total, <, and 0

Filters in the Software License Status view

Filter name

Conditions

License Violation Software

License Type, contains any of, and Install License

Remaining License Total, <, and 0

Filters in the Contract view

Filter name

Conditions

Hardware Asset

When you upgrade JP1/IT Desktop Management 2 from a version earlier than 12-10 to 12-10 or later:

Hardware Asset, >, and 0

When JP1/IT Desktop Management 2 version 12-10 or later is installed for the first time:

Contract Target, contains any of, and Hardware Assets

Software License

When you upgrade JP1/IT Desktop Management 2 from a version earlier than 12-10 to 12-10 or later:

Software License, >, and 0

When JP1/IT Desktop Management 2 version 12-10 or later is installed for the first time:

Contract Target, contains any of, and Software Licenses

Expired Contract

Contract Status, contains neither of, and Canceled, Expired

Contract End Date, before, and Today

Expired Contracts (next 1 month)

Contract Status, contains neither of, and Canceled, Expired

Contract End Date, or before, month, 1, and after

Contract End Date, or after, and Today

Filters in the Inventory module

The following table describes the filter conditions displayed in the menu area of the Inventory module.

Filters in the Device Inventory view

Filter name

Conditions

New Devices (last 7 days)

Registered Date/Time, or after, week, 1, and before

Registered Date/Time, or before, and Today

Not Confirmed Devices (last 30 days)

Last Alive Confirmation Date/Time, before, month, 1, and before

Filters in the Software Inventory view

Filter name

Conditions

New Software (last 7 days)

Registered Date/Time, or after, week, 1, and before

Registered Date/Time, or before, and Today

Unconfirmed Onerous Softwares

Managed, is, None

Software Type, contains any of, Commercial Software

Verification Status, is, Unconfirmed

Filters in the Distribution (ITDM-compatible) module

The following table describes the filter conditions displayed in the menu area of the Distribution (ITDM-compatible) module.

Filters in the Packages view

Filter name

Conditions

Removable Packages

Total Tasks, =, and 0

Filters in the Tasks view

Filter name

Conditions

Failed Tasks

Failed Computers, >, and 0

Filters in the Events module

The following table describes the filter conditions displayed in the menu area of the Events module.

Filter name

Conditions

Error Events

Type, contains any of, and Error

Filters in the Network Filter Settings view

The following table describes the filter conditions displayed in the Network Filter Settings view of the Settings module.

Filter name

Conditions

Reviewed Devices

Reviewed, is, and Reviewed

Related Topics:

2.17 Using filters

2.18 Managing a large system comprised of multiple departments or networks

You can provide multiple management servers depending on the size of the organization or network structure, to perform load distribution among system administrators and management servers, and support systems which involve a NAT environment.

A system with multiple management servers is called a multi-server configuration. A multi-server configuration is constructed hierarchically by a primary management server (that organizes the entire system), and a multiple management relay server (that controls each office or network).

The following figure shows an example system configuration with four-level hierarchy.

Each management relay server connects to one of the management servers (primary management server or management relay server) that resides one level higher in the hierarchy, to report managed information or to have configuration assigned. Each of these destination management servers is called a higher management server. Conversely, each management relay server, as viewed from the destination management server, is called a lower management relay server. In addition, lower management relay servers and management relay servers that connect to the lower management relay servers are collectively called management relay servers under the local server.

In the above example configuration, the following applies:

The higher management server of the management relay server (A): The primary management server

The lower management relay server of the primary management server: The management relay server (A) or (B)

The management relay servers under the local server of the management relay server (A): The management relay servers (A1), (A2), (A11) and (A12)

In addition, the management server to which a managed computer connects, as seen from the managed computer, is called a management server that manages the device. On the other hand, the managed computer, as seen from the destination management server, is called a computer directly under the server.

Related Topics:

1.2 System components

4.4.3 Multi-server configuration

2.18.1 Information displayed in the operation windows in a multi-server configuration

Information displayed in the operation windows differs between a multi-server configuration and single-server configuration. The following table summarizes the information displayed in the operation windows in a multi-server configuration compared to those in a single-server configuration.

Window

Information displayed in the operation windows in a multi-server configuration

Operation common to all windows

Top menu

A pulldown menu to open the operation window for a management relay server under the local server in a separate window is added.

Filter

A checkbox to display only the information managed by the local server is added.

Login window

The following items are added to the License Information section of the License Details dialog box, which can be displayed from the Login window.

Date to update product license

Total Licenses

Management server for holding licenses

Range of shared licenses

Note that items displayed in the License Information section varies for each management server depending on how the license is managed.

Home module

The Home module is separated into two tabs: the Status directly under the local server tab, and the Status of management servers under the local server tab.

The Status of management servers under the local server tab shows the hierarchical structure and overview of the management relay servers under the local server.

Security module

If a lower management relay server is configured so that the operation logs are reported to the higher management server, the operation logs collected by the lower management relay server are displayed.

Assets module

Asset information reported by management relay servers under the local server is displayed,

Inventory module

Device information reported by management relay servers under the local server is displayed.

Events module

If a lower management relay server is configured so that the operation logs are reported to the higher management server, suspicious operation events on a computer managed by the lower management relay server are displayed.

Reports module

The target of the Inventory Detail Reports includes the devices managed by management relay servers under the local server.

If a lower management relay server is configured so that the operation logs are reported to the higher management server, operation logs and suspicious operation events on a computer managed by the lower management relay server are included in the report.

Settings module

Hierarchical Configuration Under the Local Server and Operation Status is added to the site map.

A button used to apply the local server settings to management relay servers under the local server is added.

The following items are added to the License Information section of the License Details window.

Date to update product license

Total Licenses

Management server for holding licenses

Range of shared licenses

Note that items displayed in the License Information section vary for each management server depending on how the license is managed.

2.18.2 Restrictions on operations to a device managed by a management relay server under the local server

In a multi-server configuration, if the target device is managed by a management relay server under the local server, operations that can be performed from the operation window of the local server are restricted.

The following table lists the operations that can be performed on a device directly under the local server, and whether an operation can be performed on a device managed by a management relay server under the local server from the operation window of the local server. For operations that cannot be performed from the operation window of the local server, use the operation window of the server that manages the device.

Operation that can be performed on a device directly under the local server

Whether the operation can be performed on a device managed by a management relay server under the local server

Send User Notification

N

Enable End User Form (Frequent Pop-up)

Y

Enable Network Access Control

N

Disable Network Access Control

N

Allow Network Access

N

Deny Network Access

N

Power ON

N

Power OFF

N

Reboot

N

Lock Smart Device

N

Reset Smart Device Passcode

N

Initialize Smart Device

N

Edit Device Details

Y

Update Device Details

N

Create the Information Collection Tool

Y

Set Credentials

N

Move Software Licenses

Y

Remove

Y

Export Device List

Y

Export Device Details

Y

Add to Custom Groups

Y

Remote Control

Y#

Legend: Y: Can be performed. N: Cannot be performed.

#: The port number used by the management server that initiates remote control and the one used by the remotely controlled target must be the same.

Related Topics:

2.6.3 Controlling devices

2.18.3 Checking the status of management relay servers under the local server

In a multi-server configuration, you can use a higher management server to check the hierarchical structure of the management relay servers under the local server, or delete an unnecessary management relay server from the hierarchical structure. You can also check the operation status of each management relay server.

The higher management server displays the hierarchical structure and operation status of each management relay server in the Hierarchical Configuration Under the Local Server and Operation Status panel in the Home module. This information is based on the information reported by the lower management relay servers. The following table lists the information that is reported by lower management relay servers to the higher management server.

Item

Report trigger

IP address

When the agent for the management relay server automatically reports the device information to the higher management server

When an administrator of the management relay server edits the device information of the local server

User Name

Phone

E-mail

Connection information of the management relay server

Host name

When the management relay server starts

Host ID

Port number of the remote control agent

Port number for HTTP connection

If the operation logs and USB device registration information is sent to the higher management server

Date/time of final connection notification#

When the management relay server starts

When automatic notifications are sent according to the notification interval to the higher server (five minutes by default) that is specified during the server setup

#: The date and time at which the management relay server reported the connection information to the higher management server.

The lower management relay server reports the connection information of management relay servers under the server and connection information of the local server to the higher management server.

Checking the hierarchical structure of the management server

The hierarchical structure of the management relay servers under the local server is displayed in a tree structure with the local server at the top of the tree.

Deleting an unnecessary management relay server

You can delete an unnecessary management relay server and the management relay servers under the management relay server from the hierarchical structure. Note that the following information managed by the deleted management relay server will also be deleted from the management server on which deletion was performed.

Device information

Group of network segments

Tip

The device information are deleted in sequence as the management relay server that manages the devices are deleted from the hierarchical structure.

Checking the detailed information of the management relay server

You can check the detailed information of the management relay server under the local server. The following table lists the information that can be checked.

Item

Description

Summary

Status

Status of the management relay server that displays the detailed information

Date/time of final connection notification

The date and time when the management relay server that displays the detailed information most recently reported the information to the higher management server

System Details

Operation status

Operation status of the management relay server that displays the detailed information (Running, Warning, and Unknown)

Host name

Host name of the management relay server that displays the detailed information

IP address

IP address of the management relay server that displays the detailed information

Host ID

Host ID of the management relay server that displays the detailed information

Route from Local Server

Path, starting from the local server, of the management relay server that displays the detailed information

End User Information

User Name

User name of the management relay server that displays the detailed information

E-mail

E-mail address of the management relay server that displays the detailed information

Phone

Phone number of the user of the management relay server that displays the detailed information

Judging the operation status

You can set how to judge the operation status to check if management relay servers under the local server are operating properly. There are the following judgment methods:

The operation status is set to Warning when connection cannot be confirmed for the specified number of days

A management relay server whose connection cannot be confirmed for the specified number of days (from 1 to 30 days) are deemed abnormal and its operation status is changed to Warning. In addition, a warning event is issued to the higher management server, and a notification is displayed in the Home module. The operation statuses for the management relay servers lower than the connection-lost management relay server are changed to Unknown because the higher management server cannot acquire the date/time of the final connection notification for those devices.

Select this judgment method if you need to check the operation statuses of the management relay servers under the local server.

Operation statuses of all the management servers are set to Running

The operation status of the management relay servers under the local server are not monitored.

Select this judgment method if you do not need to check the operation statuses of the management relay servers under the local server.

Tip

The Hierarchical Configuration Under the Local Server and Operation Status panel in the Home module can be used to start the operation window of a management relay server in a separate window, or to start remote control. This can be useful when handling an erroneous management relay server.

Related Topics:

2.18.4 Logging in to the operation window of a management relay server under the local server

2.18.8 Remote control in a multi-server configuration

2.18.4 Logging in to the operation window of a management relay server under the local server

In a multi-server configuration, you can log in to the operation window of a management relay server under the local server from the operation window of the higher management server. For convenience, you can log in to operation windows of other management servers by a single login procedure, even when you manage multiple management servers alone, or management servers are operated in a NAT environment.

You must configure the same user ID and password for both the user account configured in the management server you are logged in to, and the server you want to log in to. In addition, the administrator's computer that displays the operation window must be able to resolve the host names of the management relay servers under the local server.

Note that the initial screen varies depending on how the operation window of the management relay server under the local server is logged in.

When logged in from the Operation-target server pulldown menu at the top of the window

The same view as the one displayed in the operation window from which the user logged in is displayed initially.

When logged in from the management server button in the Hierarchical Configuration Under the Local Server and Operation Status panel

The view you selected in the operation window from which the user logged in is displayed initially.

When logged in from the Display the Operation Window button in the Details of Management Relay Server dialog box

The Home module is displayed initially.

2.18.5 Automatic installation of the agent to the management relay server

If you install JP1/IT Desktop Management 2 - Manager as a management relay server, the agent for the management relay server is also automatically installed. In addition, the agent for the management relay server is automatically uninstalled when JP1/IT Desktop Management 2 - Manager is uninstalled. The agent for the management relay server cannot be independently installed or uninstalled.

There are functional differences between the agents installed for JP1/IT Desktop Management 2 - Agent and agents for management relay servers. The following tables list items that are different, and the functions of each type of agent.

Item

JP1/IT Desktop Management 2 - Agent

Agent for management relay servers

Installation destination

Any installation destination can be selected.

JP1/IT Desktop Management 2 - Manager-installation-folder\mgr\

Window where agent functions are configured

Agent - Windows Agent Configurations and Create Agent Installers view under the Settings module

The following views displayed while setting up JP1/IT Desktop Management 2 - Manager:

Management Relay Server Settings view

Communication Settings view

Remote Control Settings view

Assignment of the agent configurations

Agent - Windows Agent Configurations Assignment view under the Settings module

--

Window for setup

Setup of JP1/IT Desktop Management 2 - Agent

Setup of JP1/IT Desktop Management 2 - Manager

Folder name displayed in All Programs in the Windows Start menu

JP1_IT Desktop Management 2 - Agent

JP1_IT Desktop Management 2 - Manager - Agent

If it is displayed in the Programs and Features in the Windows Control Panel

Displayed

Not displayed#

Legend: --: Configuration is not required.

#: This is included in JP1/IT Desktop Management 2 - Manager.

2.18.6 Agent configuration of a managed computer in a multi-server configuration

In a multi-server configuration, the agent configuration is assigned to managed computers from the server that manages the computers. Agent configuration cannot be assigned to a managed computer that is not managed by the local server.

Note that installation set that is used to install an agent can be applied only to the computers that are discovered directly under the management server on which the installation set is created.

Tip

If you want to assign agent configuration to a managed computer that is not managed by the local server, use the operation window of the server that manages the computer.

Agent configuration items that can be set to the managed computers are the same among the primary management server, the management server in a single-server configuration, and management relay servers.

If you want to change the connection target of a managed computer, change the agent configurations from the management server that manages the computer. The managed computer whose connection target has been changed follows the new agent configuration.

Tip

If you change the agent connection target from the setup of the managed computer, the connection target might revert to the original destination at the time when the agent configuration is applied from the management server which is the original connection target. In addition, if you change the agent connection target from the original target back to the new target, the assigned policy might temporarily revert to the default policy. To change the connection target from the setup of the managed computer, do not apply the agent configuration from the original connection target, until the managed computer appears in the device list as managed in the new destination target.

2.18.7 Managing devices in a multi-server configuration

In a multi-server configuration, you can manage the device information reported from management relay servers under the local server, in addition to the device information directly under the local server.

Tip

Devices managed on the local server are subject to device maintenance. This means that, in a multi-server configuration, devices managed by management relay servers under the local server are not subject to device maintenance on a higher management server. When you use a multiple-server configuration, perform device maintenance separately on the management server and on the management relay server under the local server.

Related Topics:

2.6.2 Collecting device information

(1) Automatic device information reporting to the higher management server

In a multi-server configuration, a management relay server automatically reports the device information to the higher management server. The higher management server can collectively manage device information for device directly under the server and device information reported by the management relay server under the server.

The following figure shows the device information reporting flow in a multi-server configuration.

The conditions that trigger a lower management relay server to report the device information to the higher management server are as follows:

A device is added.

The device information is updated.

An administrator updated the device information.

Report to the higher management server includes device information of agent-installed computers and agentless computers.

The device information of offline-managed computers must be reported from an administrator's computer managed by the same server. The device information of offline-managed computers are also reported to the higher management server when the collected information is reported to the management server that manages the computers.

If you change a device type on a management relay server managing the device, and when the new device type item does not exist in the higher management server, the device type is added to the higher management server.

(2) Manual device information reporting to the higher management server

In a multi-server configuration, the device information collected by a management relay server can be manually reported to the higher management server. By manually reporting the device information, you can restore the device information inconsistency between the management servers.

If the device information becomes inconsistent between a management relay server and the higher management server due to one of the following reasons, manually report the device information.

A new management server is installed on a higher level.

The connection target management server is changed.

The connection target management server is restored.

Manually reported device information is only reflected to the connection target of the management server on which reporting is made. The information is not reflected to management servers at a level higher than the connection target management server.

(3) Editing the device information managed by a management relay server under the local server

You can use any management server to edit the device information reported by management relay servers under the management server. The device information that can be edited for devices directly under the local server and for other devices is the same.

The edited device information value is only applied to the higher management server. If you want to apply the change to the management relay servers under the server, you need to edit values in the management relay server under the server.

(4) Mechanism of changing the managing device in a multi-server configuration

If a managed computer is moved to under another management relay server, the information of the device is added to the new management relay server, and the device information is removed from the original management relay server. The following figure shows the device information flow when the managed computer is moved.

1. Collecting the device information

If a computer managed by M03 moves to under M04, the device information is collected by M04.

2. Reporting the device information (from M04 to M02)

M04 adds the device information, and then reports the device information to M02.

3. Reporting the device information (from M02 to M01)

M02 detects the device route change, and then update the device information. It also reports the device information to M01.

4. Reporting the device information (from M02 to M03)

M02 notifies M03 of deleting the device information. M03 deletes the device information.

Trigger of the notification of deleting the device information

If a device is moved between different management servers, the device route change is reflected to the configuration information held by the management servers. This triggers the notification of deleting the device information to the original management relay server.

Important

You must change the connection target in the agent configuration of the original management relay server before moving the device. For details, see the description on how to change the management server to which the agent connects in the JP1/IT Desktop Management 2 Configuration Guide.

Related Topics:

2.5.3 Assigning agent configurations to online-managed computers

(5) Applying software search conditions on a management relay server under the local server

In a multi-server configuration, you can apply the software search conditions created in the local server to the management relay servers under the local server. If you apply the search conditions, the applied conditions are added to all the management relay servers. Because a management relay server can have original search conditions in addition to the applied search conditions, a management relay server can use individual search conditions.

The software search conditions applied by the higher management server cannot be changed on the applied computer. However, the search condition can be deleted. For example, if the higher management server is replaced without applying the deletion of a search condition, delete the unnecessary search condition on the applied computer.

Related Topics:

(11) Defining search conditions for software information

(6) Collecting revision history of the devices managed by management relay servers under the local server

In a multi-server configuration, the device revision history collection target can be narrowed down to only the devices directly under the local server. If you want to distribute loads on the management server due to revision history collection, configure so that the revision history of devices other than those directly under the local server is not collected. By default, the revision history of devices other than those directly under the local server is collected.

The following shows an example multi-server configuration where the revision history of the devices other than the devices directly under the local server is not collected.

In this example, each management server only collects the revision history of the computers directly under itself. If there is no administrator for management relay server 2, the administrator of the primary management server starts the operation window of management relay server 2 to check the revision history.

Related Topics:

(17) Collecting the device revision history

(7) Deleting device information in a multi-server configuration

If you want to delete a device that no longer needs to be managed, delete the device information on the management relay server that manages the device. If a device is deleted in the management relay server, the deletion is reported to the higher management server, and the device information is deleted from the higher management server.

Conditions that trigger deletion of device information are as follows:

Trigger for device information deletion

Operation after deletion

The device information is deleted in the operation window of the management relay server that manages the device.

The device information is deleted from the higher management server.

JP1/IT Desktop Management 2 - Agent is uninstalled.

The device information is deleted from the higher management server.

This operation is based on the State_AfterAgentUninstalling value in the configuration file specified for the management relay server. Depending on the settings in the configuration file, the device information is not deleted and the management type is changed to agentless.

The Asset Status of a hardware asset is changed to Disposed.

The device information related to the disposed asset information is deleted from the higher management server and management relay servers under the local server.

Asset information is deleted in JP1/IT Desktop Management 2 - Asset Console.

The connection target management relay server of the device is changed.

The device information is deleted from the original management relay server.

Tip

If the device information reporting fails and device information becomes inconsistent between the higher management server and the management relay server that manges the device, manually delete the device information on the higher management server to restore consistency. At this time, deletion of the device information is not reported. The device information is deleted only from the higher management server.

Related Topics:

A.5 Lists of properties

2.18.8 Remote control in a multi-server configuration

In a multi-server configuration, you can remotely control not only the computers directly under the local server, but also a management relay server under the local server, and the computers managed by the management relay server. This is useful when you respond to an inquiry from a computer user, or investigate when an abnormality is detected on a computer.

The port number must be the same between the controller and the remote control agent, when you remotely control a management relay server under the local server or computers managed by the management relay server. If they have different port numbers, re-specify the port number as follows:

Port number used by the controller

If you use the primary management server to remotely control a computer, use the Options dialog box to specify the port number. If you use a management relay server to remotely control a computer, use either of the following methods:

Specify in the Options dialog box of the controller.

Specify in the setup of the management relay server.

Port number used by the remote control agent

Use either of the following methods:

Specify in the Remote control settings view for agent configuration (when you remotely control a computer managed by a management relay server under the local server).

Specify in the setup of the management relay server (when you remotely control a management relay server).

If you want to use one of the following functions while remotely controlling a management relay server under the local server or computers managed by a management relay server, AMT-related configuration is required in the Options dialog box of the controller.

Turning on a computer using AMT

Remote CD-ROM function

2.18.9 Managing network connections in a multi-server configuration

In a multi-server configuration, the network connections of the devices can be controlled by the primary management server or management relay servers.

There are two ways you can manage network connections:

Managing network connections linking with JP1/NETM/NM - Manager

Managing network connections using the network monitoring function

Managing network connections linking with JP1/NETM/NM - Manager

If you want to manage the entire network connections by the primary management server, install JP1/NETM/NM - Manager only on the primary management server. If you want to manage network connections by each management server, install JP1/NETM/NM - Manager on each management server.

If you want to manage the entire network connections by the primary management server, configure the automatic update target of the network control list to include the management relay servers under the primary management server. By doing so, connection information of the corresponding managed device (MAC address and IP address) is automatically added to, changed in, or deleted from the network control list based on the device information reported by the management relay server. By default, the automatic update target does not include the management relay server under the local server.

Even when you configure the automatic update target of the network control list to include the management relay servers under the primary management server, the network connection settings for the devices managed in the management relay servers under the local server must be performed on the management relay servers that manage those devices. The note is shown below:

On the setting dialog of the network control list of the primary management server, you can change the connection settings of the devices managed in the management relay servers under the local server but they are overwritten by notification from the management relay servers under the local server.

In addition, if multiple NICs are installed on a device, when you configure one NIC to allow access on the management relay server, all the NICs are allowed to access on the primary management server.

Important

If you configure the automatic update target of the network control list to include the devices managed by the management relay servers under the local server in a NAT environment, multiple devices with the same IP address might be added to the network control list. Therefore, if the judgement method for network connection is set to IP address, problems might occur, such as unintentional disconnection of a business-purpose device. We recommend that you choose MAC address or MAC address + IP address if you want to include the devices managed by the management relay servers under the local server in the automatic update target in a NAT environment.

Managing network connections using the network monitoring function

You can manage network connections on each management server using the network monitoring function of JP1/IT Desktop Management 2.

If you use the network monitoring function to manage network connections, there is no functional difference with managing network connections in a single-server configuration.

Related Topics:

2.8 Managing network connections

2.8.8 Managing the network control list

2.8.15 Automatic updating of the network control list

4.4.13 JP1/NETM/NM - Manager linkage configuration

2.18.10 Security management in a multi-server configuration

In a multi-server configuration, each management server controls the security of the computers directly under itself. you cannot assign a security policy from the local server to a computer managed by a management relay server under the local server. Therefore, if you want to use the same security policy on multiple management servers, create a security policy with the same settings on each management server.

2.18.11 Managing operation logs in a multi-server configuration

In a multi-server configuration, you can send the operation logs collected by a management relay server to the higher management server. If you do this, you can use the operation window of the higher management server to display or export the operation logs sent from a lower management relay server.

The following figure shows the operation logs flow when the operation logs collected by a management relay server are sent to the primary management server.

If you want to use the higher management server to display the operation logs sent from a lower management relay server, perform the following settings in the lower management relay server.

Enable collection of operation logs by the security policy.

Configure the Management Relay Server Settings view in the setup so that the operation logs are sent to the higher management server.

If you configure the Management Relay Server Settings view in the setup so that the operation logs are sent, all the operation logs including suspicious operations are sent to the higher management relay server.

If you want to display the operation logs also on the lower management relay server, configure the Operation Log Settings view of the setup so that the operation logs are collected.

For details on setting up the management relay server, see the description on setting up the management relay server in the JP1/IT Desktop Management 2 Configuration Guide.

Related Topics:

2.10 Managing operation logs

2.18.12 Managing assets in a multi-server configuration

In a multi-server configuration, you can use the higher management server to collectively manage the assets information managed by management relay servers. You can manage assets without omission by determining a management scope on which a management server is used to manage the assets.

Hardware asset information

When device information is added to a lower management relay server, the device information is reported to the higher management server. Upon notification of the device information, asset information related to the device information is registered in the higher management server.

Tip

If you want to send registration information of a USB device to the higher management server, setup is required on the lower management relay server. For details, see the description on setting up the management relay server in the JP1/IT Desktop Management 2 Configuration Guide.

Note that asset information edited by each management server is not reported to the higher management server and lower management relay servers. However, the following asset fields can be reported to the higher management server by applying the asset fields from the higher management server to the management relay servers under the local server:

Common Fields (Assets and Device Inventory)

Custom Fields (Hardware Assets), among those added by an administrator

When disposing of asset information, remove asset information relationships from the higher management server and lower management relay servers, and delete the device information. If deleting device information partially fails in the higher management server or lower management relay servers and device information becomes inconsistent among the management servers, manually delete the information on the management server on which the deletion failed.

Software information and contract information

Software information and contract information are not reported to the higher management server. Update the information on the management server at the top of the asset management scope.

Tip

A software dictionary must be registered for each management server.

Asset association information

Higher management servers do not get notified of asset association information. You must therefore update this information on the highest-level management server within the scope of asset management.

Related Topics:

2.11 Managing assets

(1) Applying asset field definitions to management relay servers under the local server

In a multi-server configuration, you can apply the asset fields of the local server from any management server to the management relay servers under the management server. You can also edit the settings of the common fields applied by the higher management server or specify custom fields in each management server individually. To apply the asset field definitions to the management relay servers under the server, use the Asset Field Definitions view of the Settings module.

Note that if you edit the settings applied by the higher management server on a management relay server, the change will not be reflected to other management servers in the multi-server configuration.

The following figure shows how the asset fields are set to management relay servers under the local server.

The user entry start date and time, common fields, and custom fields for Hardware Asset Information can be applied to the management relay servers under the server. The user entry start date and time can be edited on the management server on which the fields are applied if necessary. The following table summarizes the common fields, and whether the custom fields for Hardware Asset Information can be edited on the application target.

Asset fields

If settings can be edited on the application target

Field Name

Item Name

Data Source

Description

Type

Restricting Input Characters

Common fields

Department#1

N

Y#2

N

N

N

N

Location#1

N

Y#2

N

N

N

N

User Name

N

Account

N

E-mail

N

Phone

N

Custom fields

Custom fields (Hardware Assets)#3

N

Legend: Y: Can be edited. N: Cannot be edited (only viewed)

#1: If the data type is either enumeration or hierarchy, and the field value is not set, the asset field definitions on the applying server are not applied to the management relay server under the server.

#2: Can be edited if the data type is either enumeration or hierarchy.

#3: Configurations on asset status and device type are not applied to the management relay servers under the local server.

Important

If you apply a custom field for Hardware Asset Information, custom fields for Hardware Asset Information that are not set at the application source are deleted from the custom fields for Hardware Asset Information at the application destination.

Tip

If the device information reported by a management relay server under the local server includes a device type that is not registered in the local server, the type is automatically added to the local server.

When applying the definitions fails

Applying the asset field definitions to the management relay servers under the local server fails in any of the following cases:

The asset field to be changed or deleted is used in the following settings on the application target.

Filter condition

Value of a custom field for Hardware Asset Information

User-defined group condition

User-defined security settings

Automatic maintenance conditions for destination groups and IDs

The number of custom fields for Hardware Asset Information on the application target exceeds the upper limit.

The maximum number of fields allowed for each data type is as follows:

Number type: 20 fields

Date type: 10 fields

Enumeration type: 20 fields

Text type: 75 fields

Custom fields with the same name as the applying server were specified on the application target management relay server.

An error occurred in database accesses.

An error occurred in data communications among management servers.

A data file to be relayed is broken.

An I/O error occurred in a data folder or local data folder.

Tip

At the time of failure, applying the asset field definitions to the management relay servers under the local server is stopped.

Display order of the custom fields for Hardware Asset Information that are displayed in the Asset Field Definitions view

The custom fields for Hardware Asset Information applied from the higher management server are displayed in the Asset Field Definitions view of the Settings module in the order of the host name of the applying server. The fields applied by the same host are displayed in the order of the field names. The custom fields specified individually in each management server are displayed after the custom fields applied by the higher management server in the order of the definitions.

The following figure shows an example of how the custom fields for Hardware Asset Information is displayed.

Display order of the items in the End User Form view

The display order in the End User Form view is not applied to the management relay servers under the server. Fields applied by the higher management server appear at the bottom of the list. If multiple fields are applied, the items are displayed in order of field name. The order can also be changed on each management server.

Updating department and location on the application target

If asset field definitions are applied to the management relay servers under the local server and department or location values are updated on the application target, the group is also updated on the application target.

When a field value for departments or locations is added

A group for departments and locations corresponding to the added field value is added to the application target.

When a field value for departments or locations is changed

A group for departments and locations corresponding to the new field value is added to the application target. The group for departments and locations before the change remains the same.

When a field value for departments or locations is deleted

The group for departments and locations corresponding to the deleted field value remains the same on the application target.

2.19 Operations in a cluster system

JP1/IT Desktop Management 2 supports operations in a cluster system.

In a cluster system, when a problem occurs in the operating server, operations are automatically switched to a backup server. A cluster system can realize stable operations, where the entire system does not stop. By using a cluster system, you can continue using the services provided by JP1/IT Desktop Management 2 without being affected by problems.

JP1/IT Desktop Management 2 can introduce a cluster system using Windows Server Failover Cluster, and supports an active-standby configuration. An active-standby configuration consists of two servers: one is set as the primary node (main server) and the other is set as the secondary node (backup server).

The behavior of switching operations from the main server to the backup server is called failover. After a failover occurs, operations are performed on the backup server. The main server can then be restored to recover a normal operation environment.

The following figure shows an overview of a cluster system where JP1/IT Desktop Management 2 is installed.

When a cluster system is used, a logical host name or a logical IP address is set for the management server. Managed computers connect to this host name or IP address.

For the logical host name or logical IP address, the host name or IP address of the management server is associated. Even if the associated host name or IP address is changed, the logical host name or logical IP address will not change. Therefore, even after a failover occurs, operations can continue without the need of changing the setting of the connection target on computers.

Important

Only the management server in a single-server configuration and the primary management server in a multi-server configuration supports a cluster system. You cannot establish a cluster system with management relay servers and network monitors.

2.20 Managing the database

JP1/IT Desktop Management 2 stores various kinds of information managed by JP1/IT Desktop Management 2 in a special database created on the management server.

You must regularly maintain the database by creating a backup in preparation for problems or by re-organizing it to increase performance.

To maintain the database, use the database manager provided by JP1/IT Desktop Management 2.

The following are the database manager functions:

Backup

This function creates a backup of the database. If a disk failure should occur, information in the database might be erased or corrupted. Therefore, regularly make backups when the database is operating.

You can also back up the database by executing the exportdb command.

Restore

This function restores the database from a backup created by the backup function or by the exportdb command. If an error occurs in the database, you can use the backup to restore the database to the status as of the backup.

You can also restore the database by executing the importdb command.

Reorganize

Fragmentation of database area might occur if the database has been used for a long time. This might cause problems, such as slowdown of access speed. To prevent such problems, JP1/IT Desktop Management 2 can reorganize the database. Reorganizing the database can be done while the data remains stored, and can help to make performance more efficient. Reorganize the database regularly.

You can also reorganize the database by executing the reorgdb command.

In addition, you can use the JP1/IT Desktop Management 2 setup to upgrade or initialize the database, and to change the storage folder.

The following table describes the environments in which backed up data can be restored.

Environment in which the backup is created

Environment in which the data is to be restored

Management server in a single-server configuration

Multi-server configuration

Primary management server

Management relay server

Management server in a single-server configuration

Y

Y

Y

Multi-server configuration

Primary management server

--

Y

Y

Management relay server

--

--

Y

Legend: Y: Can be restored. --: Cannot be restored.

If you want to restore backup data to a different environment, for example when you restore a backup of the primary management server to a management relay server, you need to change the settings of the management server. For details, see a description on how to integrate multiple multi-server-configuration systems in the JP1/IT Desktop Management 2 Configuration Guide.

2.20.1 Data output during backup

When the database is backed up, in addition to the management information stored in the database, backup files for other management data stored in the database folder will be created. A backup can be created for each management server. The following table describes the files created during backup.

File name

Description

jdnexport.info

Backup information is registered in this file.

jdnexportdata.bak

Management data other than that in the database is archived in this backup file.

table.table-name.exp.bin

Tables in the database are backed up in this file.

jdnagent.nid

This file exists in the OS installation directory (%SystemRoot%). This file is created in a multi-server configuration.

2.21 Using commands

JP1/IT Desktop Management 2 provides commands to execute various functions. By using these commands in combination with Windows task scheduler or other functions, you can automatically perform operations, such as scheduled backups or output of the latest information.

For major commands such as starting or stopping a service, backing up or restoring a database, and acquiring information for troubleshooting, see the JP1/IT Desktop Management 2 Administration Guide.

For the commands related to distribution utilizing Remote Install Manager, see the JP1/IT Desktop Management 2 Distribution Function Administration Guide.

For the commands related to asset management utilizing Asset Console, see the JP1/IT Desktop Management 2 - Asset Console Configuration and Administration Guide.

2.22 Operations on users' computers

When a computer is managed online and the user's operation is required, the agent displays a balloon tip or a dialog box. For example, an agent can direct the user who violated a security policy to take an appropriate countermeasure, or let the user select the timing of downloading software. The user must take an appropriate action as indicated in the displayed message.

Users' entry of user information

When custom fields have been set, a dialog box is displayed on each computer to let the user enter user information. This can reduce administrator's tasks because information entered in dialog boxes by users is applied to device inventory. For details about entering user information, see 2.22.1 Users' entry of user information. The display of a user information entry window can be specified in the User notification settings view for the agent configuration. For details about the agent configuration, see the JP1/IT Desktop Management 2 Administration Guide. For details about how to specify the agent configuration, see the JP1/IT Desktop Management 2 Online Help.

Display of balloon tips on users' computers

If there is information that users need, a balloon tip is displayed above a taskbar icon on each computer. The balloon tip can guide the operators to do what is required on their computers. For details about balloon tips, see 2.22.2 Display of balloon tips on users' computers. The display of balloon tips can be specified in the User notification settings view for the agent configuration. For details about the agent configuration, see the JP1/IT Desktop Management 2 Administration Guide. For details about how to specify the agent configuration, see the JP1/IT Desktop Management 2 Online Help.

Behavior when users are directed to turn off the computers

After the management server directs shutting down of computers, a dialog box confirming the shutdown operation is displayed on each target computer. Each user can select to shut down the computer immediately or to manually shut down the computer later. For details, see 2.22.3 Behavior when users are directed to turn off computers.

Behavior when users are directed to restart the computers

After the management server directs restart of computers, a dialog box confirming the restart operation is displayed on each target computer. Each user can select to restart the computer immediately or to manually restart the computer later. For details, see 2.22.4 Behavior when users are directed to restart computers.

Behavior when distribution is performed on users' computers

A balloon tip is displayed above a taskbar icon while software is being downloaded. Users can click the balloon tip to suspend the download.

When installation of a downloaded software program starts, a pre-installation message is displayed to users (if one has been set). Each user can select whether to install the software immediately or to install it later.

For details, see 2.22.5 Behavior when distribution is performed on users' computers. The display of balloon tips can be specified in the User notification settings view for the agent configuration. For details about the agent configuration, see the JP1/IT Desktop Management 2 Administration Guide. For details about how to specify the agent configuration, see the JP1/IT Desktop Management 2 Online Help.

Behavior when operations are restricted on users' computers

Users' attempts to start improper software, print large amounts of data, or use prohibited external media can be restricted. Attempts to move information in or out can also be restricted. For details, see 2.22.6 Behavior when operations are restricted on users' computers.

Connection request for remote control

In an NAT environment (where devices cannot be viewed from the controller) or in an NAPT environment (where IP addresses for devices change), it is difficult for the controller to remotely connect to computers. In such a case, connection requests from user computers to the controller, can be used to initiate remote control. For details, see 2.7.16 Issuing connection requests from remote computers to controllers.

2.22.1 Users' entry of user information

A window for entering user information can be displayed on online-managed computers when, for example, the settings for custom fields are changed on the management server. Whether to display a user information entry window can be selected in the User notification settings view for the agent configuration.

If entry of user information is being requested, users can also open a context menu from the taskbar icon () to display a window for entering user information.

If the data source for asset fields is End User, a user information entry window appears when one of the following occurs.

Asset fields are added, edited, or deleted on the management server (if asset fields are deleted, there must be remaining asset fields whose data source is End User).

The latest information of a device is obtained by selecting Update Device Details from the Action menu.

The time specified in the dialog box that opens by selecting Enable End User Form (Frequent Pop-up) from the Action menu is reached.

The time specified in Specified (a specified date and time for starting entry, in the local time of the user computers) in Start Date for Entry of User Information of the Settings module is reached.

30 minutes have passed since the user information entry window was last displayed.

30 minutes have passed since the user information entry window was closed with no information entered.

A user logs on to the computer.

Tip

If you edit, add, or delete asset management items or execute Update Device Details, before the date and time specified for Enable End User From (Frequent Pop-up), the computer will display a message asking the user to enter user information.

User information can be entered in the End User Form view. The fields displayed in this view differ depending on the extended information specified on the management server.

The following shows an example of display in the End User Form view.

The following describes how to enter individual fields. Note that the fields with an asterisk (*) are mandatory.

Fields in which text is directly entered

You can enter no more than 256 characters in text fields. To check the characters that can be entered, click the Allowed Characters button and check the character information.

Fields for which text is selected from a pull-down menu

You can select a text from the pull-down menu. Selection items might be displayed in a tree. Select the relevant text.

Back button

Clicking this button returns the previous page. This button is displayed when there are 6 or more fields in a page. This button is not displayed for the first page.

Next button

Clicking this button moves to the next page. This button is displayed when there are 6 or more fields in a page. This button is not displayed for the last page.

Complete button

Clicking this button notifies the management server of the entered user information, and then closes the End User Form view. If the mandatory fields have not been filled, a message requesting entry is displayed.

Cancel button

Clicking this button cancels the information you entered.

Allowed Characters

Select a target field and click this button. The characters that can be entered in that field are displayed.

The following figure is an example showing a display of characters that can be entered.

To hide the display of characters that can be entered, click the Allowed Characters button again.

Before the start time specified for entry of user information reaches, selecting Windows Start, All Programs, JP1_IT Desktop Management 2 - Agent, and then End User Form on the user's computer causes the following window to appear:

Note that, with the Citrix XenApp and Microsoft RDS server, a window for entering user information is not displayed.

2.22.2 Display of balloon tips on users' computers

When a user operation is required, a balloon tip is displayed on a taskbar icon. Users can check balloon tips to understand the necessary operations. The following figure shows an example of a balloon tip.

A balloon tip starts with an icon which indicates the message type. The following are the meanings of the icons:

: Information

: Warning (Lower level risk)

: Critical (Higher level risk)

Whether to display balloon tips can be selected in the User notification settings view for the agent configuration. The following table describes behavior when balloon tips are displayed and hidden.

Trigger

Message to be displayed

Behavior when the balloon tip is clicked

Influence if balloon tips are hidden, and action to be taken

A message about security judgment results is received from the system administrator.

You received a new message on message-title from Administrator. Click here to view.

A message about the results of the security status judgment is displayed.

To view the message, the user must open a context menu from the taskbar icon and then select Display Message.

A security policy that requires restart of the computer is applied.#

Restart the computer. The computer must be restarted for the following reasons.

(1) The security policy was applied and the computer settings were changed.

(2) The latest component was installed on the computer.

(3) Software or an updated program was installed on the computer.

None

If the computer is not restarted immediately, security measures for the computer might be delayed.

Specify to hide balloon tips on computers that need not be prompted to restart. For servers that are not restarted under normal conditions, specify to display balloon tips to show the necessity of a restart.

Entry of user information is requested from the system administrator.

Enter user information. Click here to enter.

The End User Form view appears.

To display a window to enter user information, open a context menu from the taskbar icon, and then select End User Form.

#: The following security policies require restart of a computer: Disable Anonymous Access, Enable Automatic Windows Update, Disable Remote Desktop, Disable Administrative Share, Disable DCOM, device write-operation restriction, and enable or disable operation logs or suspicious operations. Note that for security policy Enable Windows Firewall, restart is required if Windows 7 or Windows Server 2008 R2 is running on the computer.

Tip

Balloon tips are also displayed while software is being downloaded. For details, see 2.22.5 Behavior when distribution is performed on users' computers.

If more than one trigger occurs, balloon tips are stacked and displayed in the order of the triggers listed in the above table. Closing the displayed balloon tip will display the next balloon tip.

A balloon tip is closed when 10 seconds have passed since it was displayed or when the button is clicked. Also, for Windows 2000, nothing occurs when you click the balloon tip. If the user does not take action indicated in the balloon tip, the same balloon tip will be displayed again in 30 minutes. The following table describes the display timing of balloon tips.

Computer status

Display timing of a balloon tip

Logging on

A balloon tip is displayed immediately after a trigger (such as receiving a message about security judgment results) occurs.

If the user does not take the action indicated in the balloon tip, the same balloon tip will be displayed again 30 minutes later.

If the user does not take the action indicated in the balloon tip, the same balloon tip will be displayed again when the agent service is restarted.

Logging off

A balloon tip will be displayed at the next logon.

Computer is locked

A balloon tip will be displayed when the computer is unlocked.

Important

When the computer OS is Windows Server 2019, Windows Server 2016, Windows 10, Windows 8.1, Windows 8, Windows Server 2012, Windows 7, or Windows Server 2008 R2, the icon in the taskbar is usually hidden. To keep the icon displayed, customize the following setting.

In case of Windows Server 2019, Windows Server 2016, Windows 8.1, Windows 8, Windows Server 2012, Windows 7 or Windows Server 2008 R2:

Customize the notification area of the taskbar (set the behavior of the JP1/IT Desktop Management 2 - Agent icon to Show icon and notifications).

In case of Windows 10:

Select Settings - System - Notifications & actions - Select which icons appear on the taskbar, turn on the JP1/IT Desktop Management 2 - Agent icon.

2.22.3 Behavior when users are directed to turn off computers

When the management server directs agent-installed computers to turn off, the Shutdown Computer dialog box will be displayed. Such agent-installed computers will be shut down 180 seconds after the Shutdown Computer dialog box is displayed.

The following figure shows the Shutdown Computer dialog box.

Shutdown Now button

Clicking this button immediately shuts down the computer.

Shutdown Later button

Clicking this button cancels shutdown of the computer. The Shutdown Computer dialog box will not be displayed again, so the user must manually shut down the computer after clicking this button.

The following are notes on shutting down a computer:

If the screen saver is activated and the screen is password-protected, the computer will not be automatically shut down.

If the computer is locked, it will not be automatically shut down.

If there is a file being edited, the computer will not be automatically shut down.

If another user is logged on, the computer will not be automatically shut down.

If no user is logged on, the computer will be automatically shut down without displaying the Shutdown Computer dialog box.

If the computer receives notification of turning off the computer from the management server while the Shutdown Computer dialog box is being displayed, subsequent notifications will be disabled.

If a user selects Shut down immediately but refuses to close applications, the shutdown operation will be cancelled. However the Device Status in the management console might be displayed as "power is off".

2.22.4 Behavior when users are directed to restart computers

When the management server directs agent-installed computers to restart, the Computer Restart Settings dialog box will be displayed. The behavior (restart timing) related to this dialog box differs depending on the settings in Settings to shut down and restart the computer (under User notification settings) of Agent Configurations.

If Automatically start if no response is received from the user within the specified period has been selected, the computer will automatically restart when the time specified in Agent Configuration has passed after the dialog box is displayed. This will occur even if the user does not respond to the dialog box.

If Follow the response of the user in the dialog box that instructs the user to shut down or restart the computer has been selected, the computer will restart after the user responds to the dialog box. The computer will not restart automatically.

If you disable Settings to shut down and restart the computer under User notification settings in the Agent Configurations, the Restart Computer dialog box will not be displayed and you will not be asked to restart your computer.

The following figure shows the Computer Restart Settings dialog box when Automatically start if no response is received from the user within the specified period has been selected.

Immediate Installation button

Clicking this button immediately restarts the computer.

Restart Later button

Clicking this button cancels restart of the computer. The Computer Restart Settings dialog box will not be displayed again, so the user must manually restart the computer after clicking this button.

The following are notes on restarting a computer:

If the screen saver is activated and the screen is password-protected, the computer will not be automatically restarted.

If the computer is locked, it will not be automatically restarted.

If there is a file being edited, the computer will not be automatically restarted.

If another user is logged on, the computer will not be automatically restarted.

If no user is logged on, the computer will be automatically restarted without displaying the Computer Restart Settings dialog box.

If the computer receives notification of turning off the computer from the management server while the Computer Restart Settings dialog box is being displayed, only the notification of turning off the computer will be enabled. In this case, the Computer Restart Settings dialog box will be cancelled, and the Shutdown Computer dialog box will be displayed.

2.22.5 Behavior when distribution is performed on users' computers

When software is distributed, a balloon tip is displayed on a taskbar icon or a dialog box is displayed. To distribute software, you must create a package and task in the Distribution (ITDM-compatible) module. For a task, you can set an execution schedule for software distribution, execution timing of installation after software is distributed to target computers, and a message to be displayed before the installation.

The following describes the behaviors in individual cases:

Download

A balloon tip is displayed on a taskbar icon when download starts or when a user logs on to the computer. The following figure shows an example of a displayed balloon tip.

A balloon tip starts with an icon which indicates the message type. The following are the meanings of the icons:

: Information

: Warning (Lower level risk)

: Critical (Higher level risk)

Whether to display balloon tips can be selected in the User notification settings view for the agent configuration. The following table describes behavior when balloon tips are displayed and hidden.

Trigger

Message to be displayed

Behavior when the balloon tip is clicked

Action to be taken when balloon tips are hidden

Download starts

Downloading the package now... If you want to pause download, click here.

A dialog box confirming that the download will be paused, and the download is paused.

To interrupt the download, click the download icon.

Download restarts

A balloon tip is closed when 10 seconds have passed since it was displayed or when the button is clicked. When you click a balloon tip, the behavior corresponding to the tip occurs. The following table describes the timing balloon tips are displayed.

Computer status

Display timing of a balloon tip

Logging on

A balloon tip is displayed immediately after download starts or restarts.

If the user does not take the action indicated in the balloon tip, the same balloon tip will be displayed again when the agent service is restarted.

Logging off

A balloon tip will be displayed at the next logon.

Important

When the computer OS is Windows Server 2019, Windows Server 2016, Windows 8.1, Windows 8, Windows Server 2012, Windows 7, or Windows Server 2008 R2, the icon in the taskbar is usually hidden. To keep the icon displayed, customize the notification area of the taskbar (set the behavior of the jdnglogon icon to Show icon and notifications).

If the computer OS is Windows 10, turn on the JP1/IT Desktop Management 2 - Agent icon.

Installation

When a confirmation message must be displayed before the distributed software is installed, the message is displayed in a dialog box. The following figure shows an example of such a dialog box.

Immediate Installation button

Clicking this button immediately installs software on the computer.

Install later button

Clicking this button cancels installation of software. If the time specified for Notify later has passed, the same dialog box will be displayed again.

A dialog box is displayed before software is installed. The display timing of a dialog box differs depending on the computer status and the installation timing (execution timing) of software set by the administrator for the distribution task.

The following table describes the display timing of the dialog box.

Computer status

Execution timing

Display timing of a dialog box

Logging on

Installation will be performed at the next startup.#

A dialog box is displayed immediately.

Installation is performed immediately.#

Installation is performed when a user logs on.

Logging off

Installation will be performed at the next startup.

No dialog box is displayed.

Installation is performed immediately.

Installation is performed when a user logs on.

A dialog box will be displayed at the next logon.

#: If a computer is restarted when the confirmation dialog box for installation remains displayed or when the Install later button has been clicked, after the computer is restarted, installation will start without displaying the confirmation dialog box for installation.

2.22.6 Behavior when operations are restricted on users' computers

You can restrict user attempts to start improper software, perform print operations, or use a prohibited device. This functionality provides a convenient means of maintaining security within a company, by restricting movement of information.

Blocking startup of software

When a user starts unauthorized software or uses software that is allowed during a specified period only, the Software Startup Suppression dialog box might be displayed. The software might be automatically stopped depending on the usage status.

Clicking the OK button in the Software Startup Suppression dialog box closes the dialog box.

The following describe the notification messages displayed in the Software Startup Suppression dialog box.

Note that if the OS on a user's computer is Windows Server 2019, Windows Server 2016, Windows 10, Windows 8.1, Windows 8, or Windows Server 2012, a dialog box is displayed on the desktop of the user's computer.

Notification of blocked software

Displayed when there is an attempt to start unauthorized software. The following figure shows a display example.

Notification of the time the software is available

Displayed when the software allowed for use during a specified period is being used during that period. The following figure shows a display example.

Notification of the time the software is unavailable

Displayed when the software allowed for use during a specified period is being used and the period will end soon. When the period has passed, the software is automatically stopped. The following figure shows a display example.

Blocking printing

When printing is performed on an agent-installed computer to which a security policy for blocking printing is applied, the Printing suppression dialog box for blocking printing is displayed. Clicking the OK button closes the dialog box.

Note that if the OS on a user's computer is Windows Server 2019, Windows Server 2016, Windows 10, Windows 8.1, Windows 8 or Windows Server 2012, a dialog box is displayed on the desktop of the user's computer.

The following figure shows the Printing suppression dialog box.

When allowed, the user can use a password to release the blockage of printing. To perform this, double-click the Block Printing icon () in the taskbar. The Release Printing Suppression dialog box (for entering a password) is displayed. Enter the necessary password, and then click the OK button.

Note that if the OS on a user's computer is Windows Server 2019, Windows Server 2016, Windows 10, Windows 8.1, Windows 8 or Windows Server 2012, a dialog box is displayed on the desktop of the user's computer.

The following figure shows the Release Printing Suppression dialog box (for entering a password).

If blockage of printing could be released, the Release Printing Suppression dialog box (indicating a successful operation) is displayed. The user will then be able to perform printing. If blockage of printing could not be released, the Release Printing Suppression dialog box (indicating a failure operation) is displayed. Clicking the OK button closes the dialog box.

If the user clicks the Block Printing icon () when a password for releasing blockage of printing cannot be used, a dialog box indicating that printing is being blocked is displayed. Clicking the OK button closes the dialog box.

Restricting use of devices

When a device is used on an agent-installed computer with a security policy for restricting the use of the device applied, and if the security policy is configured to display a message, the Device usage suppression dialog box appears. Clicking the OK button closes the dialog box.

2.22.7 Users who receive notifications from the agent

If more than one user logs on to the same computer, notifications (such as balloon tips and dialog boxes) are informed to only part of the users. By restricting the notification-target users, the users who do not need to take action will not need to deal with unnecessary information.

The following are notification-target users for individual OSs installed on agent-installed computers:

For Windows 10, Windows 8.1, Windows 8, or Windows 7

All logged on users

Users who logged on by using a Remote Desktop connection

For Windows Server 2019, Windows Server 2016, Windows Server 2012 or Windows Server 2008 R2

Users who logged on to the local console

The user with administrative privileges who logged on first by using a Remote Desktop connection

2.22.8 Notes on users' computers

Do not disable the applications below on users' computers. If these applications are disabled, some JP1/IT Desktop Management 2 functions might not work correctly.

jdngrcagent.exe

jdngrcchat.exe

jdnglogon.exe

jdngsmclogin.exe

2.23 Controlling smart devices

By linking with MDM systems, JP1/IT Desktop Management 2 can control managed smart devices. This function is convenient because you can control smart devices without the need of operating MDM systems.

Important

Controlling smart devices is not available for devices acquired using Google Workspace as MDM System.

In a multi-server configuration, you need to link with an MDM system for each management server that is intended to control smart devices.

By linking with MDM systems, you can perform the following types of control on smart devices:

Locking smart devices

The administrator can lock a smart device so that if the user loses the smart device, a finder cannot operate it.

Resetting the passcodes for smart devices

The administrator can reset the passcode for a smart device so that when the user forgets the passcode, the same user can set a new passcode.

Important

If you use Microsoft Intune as MDM system, resetting passcode of smart device is not possible.

Initializing smart devices

The administrator can initialize a smart device to the factory settings when changing the user of a smart device or when disposing of a smart device.

Smart devices are controlled by MDM systems that respond to requests issued by JP1/IT Desktop Management 2. The following figure shows the flow of controlling smart devices.

Important

If the settings for linking with an MDM system are deleted, the smart devices managed by that MDM system can no longer be controlled.

Important

In a multi-server configuration, do not link an MDM system of the same configuration with different management servers. The managing device of the smart devices changes unintentionally at the time when each management server obtains information from the MDM system, and smart devices might not be controlled properly.

Important

If you use Microsoft Intune as MDM system, perform the following Microsoft Intune actions for each JP1/IT Desktop Management 2 of control:

Lock for smart device: Remote lock Actions

Smart device Initialization: Wipe Action

For more information about the specifics of Microsoft Intune actions, see documents of the Microsoft Intune.

Tip

JP1/IT Desktop Management 2 considers that target smart devices have been controlled when an MDM system receives the relevant requests.

Related Topics:

2.6.6 Linking with an MDM system

2.24 Managing devices used outside the company

With JP1/IT Desktop Management 2, online management is possible even when managed computers are connected from outside the company via the Internet. The management of computers is possible not only when the management server and users' computers are connected to one another via VPN but also when a VPN connection is not used.

Tip

An agent must be installed on managed computers.

VPN connection

Managed computers are connected to the management server via VPN. JP1/IT Desktop Management 2 provides a batch file for setting up a VPN connection environment, and uses the distribution function to enable easy setup of a VPN connection environment.

Internet connection

Place an Internet gateway server in the DMZ of the corporate network, and then connect it with the management server. Managed computers and the management server are connected to one another via the Internet gateway server. Managed computers and the Internet gateway server are connected to one another via HTTPS.

You can also connect a management relay server to an Internet gateway over the Internet.

Difference in the available functions depending on the connection mode used

The functions available from the management server vary depending on whether managed computers are connected via VPN or via the Internet. The following table describes the difference in the available functions depending on the connection mode used:

Function

Managed computer

VPN connection

Internet connection

Acquisition of device information

Y

Y

Security diagnostics

Assign security policies

Y

Y

Evaluate security

Y

Y

Actions at security policy violation

Automatic security measures

Y

Y

Restrict printing

Y

Y

Disable data export

Y

Y

Disable software startup

Y

Y

Acquire operation logs

Y

Y

Send warning messages

Y

Y

Power on

N

Y

Management of asset information

Manage hardware

Y

Y

Manage software licenses

Y

Y

Manage software

Y

Y

Manage contracts

Y

Y

Distribution of software and files

Distribute software

Y

Y#

Distribute files

Y

Y#

Uninstall software

Y

Y

Remote control of devices

Remote control of computers

Y

N

Connection requests from computers

Y

N

File transfer

Y

N

Chat

Y

N

Management of device network connections

Enable network access control

N

N

Control network connections

N

N

Report creation

Y

Y

Legend: Y: Supported. N: Not supported.

#: A relay system is not available.

2.24.1 Managing devices connected via VPN

By using JP1/IT Desktop Management 2, you can keep track of the managed computers taken out of the office by employees working off-site from home or a satellite office by connecting those computers via VPN.

To connect managed computers via VPN, you have to first set up a VPN connection for the computers. JP1/IT Desktop Management 2 allows you to distribute a batch file for setting up a VPN connection environment to managed computers, which enables easy setup of a VPN connection environment.

JP1/IT Desktop Management 2 provides sample batch files for setting up a Window's standard VPN client environment.

For details about setting up a VPN connection for managed computers, see the description of configuring a VPN connection of a PC for use outside the company in the manual JP1/IT Desktop Management 2 Administration Guide.

2.24.2 Managing devices connected via the Internet

By using JP1/IT Desktop Management 2, you can keep track of the managed computers taken out of the office by employees working off-site from home or a satellite office without the need to set up a VPN connection.

In this case, you have to set up an Internet gateway server in the demilitarized zone (DMZ) of the corporate network and then connect the server to the management server. Managed computers and the management server are connected to one another via the Internet gateway server. Managed computers and the Internet gateway server are connected to one another via HTTPS.

Tip

As shown in the following figure, a management relay server located outside the company is connected to the internet. the management relay server and the internet gateway server are connected one another via HTTPS. Because of that, the management relay server and managed computer located outside the company can be managed by the management server located in a company.

Important

Note that, when you keep track of computers connected via the Internet, the available functions vary from when a VPN connection is used. For details, see 2.24 Managing devices used outside the company.

(1) Managing connected devices

Devices connected via the Internet are managed as described below.

Prerequisites

The following prerequisites apply to devices managed through Internet connection:

Only devices (computers) running Windows as the OS can be managed.

An agent must be installed on each computer to be managed.

The network monitor must be disabled on managed computers.

Important

Agentless devices cannot be managed.

Important

Whenever a managed computer is taken out of the company for use, Wake on LAN and the AMT BIOS setting must be disabled to prevent inadvertent activation of the computer.

To manage devices through Internet connection:

In the Agent Configurations view of the Settings module on a managed computer, select Basic settings, and then the Perform HTTPS communication with the higher system via the Internet Gateway check box.

If you enable this setting, the agent communicates with the management server and the relay system via the Internet gateway.

Network connection control

A managed computer used outside the company is not subject to network connection control.

Furthermore, when a managed computer is used outside the company, an IP address that is different from the one managed in the internal network is set. For this reason, if network connection control is performed based on a network control list with IP addresses used for judgment, network connection control for managed computers might not work properly. For this reason, we recommend that you use MAC addresses for judgment when performing network connection control based on a network control list.

Switching the connection destination of managed computers which brings to inside of the company

You can operate the managed computers connect to the management server or the relay system directly when they are brought to inside of the company.

To disable connection to the Internet gateway from managed computers inside of the company, you have to edit both the firewall and proxy server settings. For details, see the description about managing devices used outside the company in the manual JP1/IT Desktop Management 2 Administration Guide.

To manage device through a management relay server which connected the Internet:

For management relay server to connect to higher management server through an Internet gateway, you must create an Internet connection configuration file in management relay server and execute rlyigwsetconf commandI will do it. For details, see the description of the procedure for connecting a management relay server to an Internet gateway in the manual JP1/IT Desktop Management 2 Configuration Guide.

(2) Precautions for managing devices via Internet connection

You have to observe the following precautions when managing devices via Internet connection:

When communicating with a higher system via the Internet gateway

The automatic or manual security measures are executed when a polling from the agent occurs.

The computer operation performed by an administrator is executed when a polling from the agent occurs.

The distribution of software and files by means of ITDM-compatible distribution is executed when a poling from the agent occurs.

The software and file distribution job that uses Remote Installation Manager is executed when a polling from the agent occurs.

When collecting files with large capacity exceeding 1 GB with the remote collection function, change the setting for Communication Settings - Communication Error Settings - Timing to assume that a communication error occurred - Assume that a communication failure occurred if no response is received from communication software within the specified period of Agent Configuration to 120 minutes. If the setting value is increased, when there is no response from the server due to a temporary failure such as communication failure or server failure, it takes time until it is assumed as an error, so the time to the next polling will be longer. After changing the setting, wait for the amount of time (or longer) specified in the Basic Settings - Timing of Communication with the Higher System - Polling Timing - Periodically perform polling on every system startup.

When distributing packages of 50 MB or more using the Remote Install Manager, communication timeout may occur, distribute by splitting the package to size within 50 MB.

If ITDM-compatible distribution fails while in progress due to a communication error, retry at the next polling timing.

When managed computers are connected to the internal network

If, while a managed computer connected to the internal network is turned off, the management server issues a request with the setting that enables automatic activation by means of Wake on LAN or AMT enabled, the request is received upon the occurrence of a polling at the time of system startup. Under this circumstance, a request might be executed with lower delay compared to when the managed computer is turned on.

When managed computers are connected to a network outside the company

When network connection is cut off or allowed based on the judgment made in accordance with the security policy, the network control list is updated, but the control of the network connection of computers used outside the corporate network is not performed.

Computers used outside the corporate network cannot be activated by Wake on LAN or AMT.

Switching the connection network of the managed computer

Before the Distribution that Uses Remote Install Manager job to the computer in the internal network environment is completed, if you take the computer out to the Internet environment, the job will be interrupted. The job will resume when the computer reconnected to the internal network environment.

Also, before the Distribution that Uses Remote Install Manager job to the computer in the Internet environment is completed, if you bring the computer back to the internal network environment, the job will also be interrupted. The job will resume when the computer reconnected to the Internet environment.

2.25 Operation in a large-scale environment

In JP1/IT Desktop Management 2, you can manage a maximum of 300,000 devices.

If you manage 50,000 devices or more, enable the large-scale management option when installing JP1/IT Desktop Management 2 - Manager.

There are differences in some functions depending on whether the large-scale management option is enabled or disabled.

2.25.1 Differences due to the large-scale management option

The following table shows differences due to whether the large-scale management option is set to enabled or disabled when the management server is installed.

Functional differences

Item

Large-scale management option disabled

Large-scale management option enabled

Security judgment

Security judgments are performed when device information is collected from a device and at specified times.

Security judgments are performed at specified times.

If a device violates a security policy, the actions below are taken once a day when security judgment is performed:

Message notification to the user

Network connection control

Migration to the management relay server

Possible.

Not possible.

Differences in the default values (agent settings)

Item

Large-scale management option disabled

Large-scale management option enabled

Monitoring Interval (Security)

10 minutes

240 minutes (4 hours)

Monitoring Interval (Others)

60 minutes

1,440 minutes (24 hours)

Polling interval

30 minuts

240 minutes (4 hours)

Differences in the default values (security management settings)

Item

Large-scale management option disabled

Large-scale management option enabled

Judgment Time in Security Schedule

0:00

18:00

Management window (Home module and dashboard)

When the large-scale management option is enabled during installation of the management server, different panels are initially displayed in the Home module or in the dashboard.

Category

Panel

Large-scale management option disabled

Large-scale management option enabled

Alternate screen

Home

System Summary

Y

N

The same information can be viewed in the following windows:

At Risk Devices: Device List under Computer Security Status in the Security module

Discovered Nodes: Discovered Nodes under Discovery in the Settings module

Managed Devices: Device List under Device Inventory in the Inventory module

Computers on which no agent is installed: Windows Agent Deployment under Agent in the Settings module

Unconfirmed Hardware Assets: Department List or Location List under Hardware Assets in the Assets module

Managed Hardware Assets: Department List or Location List under Hardware Assets in the Assets module

Newly connected devices (within the last week): Device List under Device Inventory in the Inventory module

Idle devices (one month): Device List under Device Inventory in the Inventory module

Used Licenses: License Details under Product Licenses in the Settings module

Not Ack Event Summary

Y

Y

-

Background Task

Y

N

The same information can be viewed in the following windows:

Last Import Log under Assets in the Settings module

Windows Agent Deployment under Agent in the Settings module

Last Discovery Log under Discovery in the Settings module

Discovered Nodes under Discovery in the Settings module

Topic

Y

Y

-

DB and Disk Usage

Y

N

The same information can be viewed in the following windows:

Event List in the Events module

Category Security Assessment

Y

N

The same information can be viewed in the following windows. However, the information of the previous day cannot be viewed.

Current Diagnosis under Security Diagnosis Reports in the Reports module

Windows Update Status under Security Detail Reports in the Reports module

Antivirus Software Status under Security Detail Reports in the Reports module

Unauthorized Software Status under Security Detail Reports in the Reports module

Security Settings Status under Security Diagnosis Reports in the Reports module

Other Access Restrictions Top N under Security Diagnosis Reports in the Reports module

Status of Management Servers Under the Local Server

Y

Y

-

Security

Dashboard

Category Security Assessment

Y

N

The same information can be viewed in the following windows. However, the information of the previous day cannot be viewed.

Current Diagnosis under Security Diagnosis Reports in the Reports module

Windows Update Status under Security Detail Reports in the Reports module

Antivirus Software Status under Security Detail Reports in the Reports module

Unauthorized Software Status under Security Detail Reports in the Reports module

Security Settings Status under Security Diagnosis Reports in the Reports module

Other Access Restrictions Top N under Security Diagnosis Reports in the Reports

No. of Devices by Violation Level

Y

N

The same information can be viewed in the following windows:

Device List under Computer Security Status in the Security module

Suspicious Operations

Y

N

The same information can be viewed in the following windows:

Operation Log List under Operation Logs in the Security module

Security Status by Policy

Y

N

The same information can be viewed in the following windows:

Security Policy List under Security Policies in the Security module

Assets

Dashboard

Hardware Assets Trend

Y

N

The same information can be viewed in the following windows:

Department List or Location List under Hardware Assets in the Assets module

Hardware Assets under Asset Detail Reports in the Reports module

Customized HW Assets (Group/Filter)

Y

N

The same information can be viewed in the following windows:

Department List or Location List under Hardware Assets in the Assets module

Expired Contracts (next 3 months)

Y

N

The same information can be viewed in the following windows:

Contract List under Contracts in the Assets module

Software (License Violation)

Y

N

The same information can be viewed in the following windows:

Software License List under Software Licenses in the Assets module

Inventory

Dashboard

Managed Nodes Trend

Y

N

The same information can be viewed in the following windows:

Windows Agent Deployment under Agent in the Settings module

Device Management Status under Inventory Detail Reports in the Reports module

Customized Device Inventory (Group/Filter)

Y

N

The same information can be viewed in the following windows:

Device List under Device Inventory in the Inventory module

No. of Devices by OS

Y

N

The same information can be viewed in the following windows:

Device List under Device Inventory in the Inventory module

New Software

Y

N

The same information can be viewed in the following windows:

Software List under Software Inventory in the Inventory module

Distribution (ITDM-compatible)

Dashboard

Task Status

Y

N

The same information can be viewed in the following windows:

Task List under Tasks in the Distribution (ITDM-compatible) module

Error Task Status

Y

N

The same information can be viewed in the following windows:

Task List under Tasks in the Distribution (ITDM-compatible) module

Legend: Y: Visible by default, N: Not visible by default, -: No need for alternate screen

Management window (list view)

When the large-scale management option is enabled during installation of the management server, different panels are initially displayed in the Home module or in the dashboard.

Item

Large-scale management option disabled

Large-scale management option enabled

Total number of items in the list

The list view of the management window shows the total number.

The list view of the management window may show "-" as the total number.#

#: If the total number is not visible, you can see it by turning off the filter of the list.

2.25.2 Restrictions when the large-scale management option is enabled

The following are the restrictions when the large-scale management option is enabled:

Managed device

Of devices managed by the management server (those managed directly by the primary management server in the multi-server configuration), the number of devices other than agent-controlled devices (such as agentless devices) must be less than or equal to 50,000.

Operation log

1A single management server enables you to manage operation logs of up to 30,000 devices. If you want to manage logs of more devices, use the management relay server.

Asset management through Asset Console

Asset Console enables you to manage up to 30,000 devices.

IP search

The number of devices to be found through IP search must be less than or equal to 50,000. If you want to find more devices, use the management relay server.

Network connection control

A single management server can provide network connection control over up to 262,140 pieces of network information (MAC address or IP address). For example, if one device has two pieces of network information, then the server can provide network connection control over up to about 130,000 devices. If you want to provide network connection control over more devices, use the management relay server.

What should be considered about operation windows when the large-scale management option is enabled

Taking into account the load on the server, consider the following items about operation windows when the large-scale management option is enabled:

Set the maximum number of displayed items per page on a list view to 100.

Change the items displayed on the list view to only those that are necessary.

Change the panels displayed on the Home module and the dashboard for each view to only those that are necessary.

Define only the minimum required number of filters and custom groups. Remove a filter or custom group if you no longer need it.

Define only the minimum required number of security policies and agent settings. Remove a security policy or agent setting if you no longer need it.

2.26 Priority distribution

The priority distribution function can be used to distribute security patches and other urgent patches.

The following table describes the functions that support priority distribution.

Item

Description

Priority distribution function

Allows distribution jobs to switch packages for download according to the priority set for the package.

Set priority function

Allows the user to configure priority settings when packaging from Packager.

Change priority function

Allows the user to change the priority of a package when executing distribution jobs in RIM.

Agent settings

Allows the user to enable or disable the priority distribution function, and set the interval for checking jobs.

2.26.1 Priority distribution function

When downloading packages, the priority distribution function suspends the download and checks jobs on the higher system at preset intervals. If another job is being executed, the priority distribution function checks whether it contains a package with a higher priority.

If the job contains a package with a higher priority, the priority distribution function switches to downloading and installing the higher priority package.

If the higher priority package is already being downloaded, the download resumes. Jobs are only checked during downloads. Jobs that are being installed are not suspended to check priority.

The Waiting for execution status appears for subsequent jobs executed when running multiple distribution jobs in version 12-60 and earlier versions of JP1/IT Desktop Management 2. With the priority distribution function, the status of all distribution jobs appears as Running as jobs are continually received while downloads are in progress.

2.26.2 Set priority function

You can configure priority settings when packaging using Packager or commands.

The following table describes the set priority function settings.

Setting

Description

Application

Configurable values

Default value

Priority

Specifies the priority of a package.

Packages

1 to 9

5

The priority level of packages in the priority distribution function is expressed on a scale of 1 to 9. The larger the number, the higher the priority.

The priority level is a relative value for comparing the order of priority between packages. The value by itself carries no intrinsic meaning. For example, if regular packages are distributed with a priority level of 7, distributing a package with a priority level of 6 gives it a lower priority level.

Priority levels can be set and used in the following ways:

To distribute regular packages at a priority level of 1, and urgent packages at a priority level of 2. Packages with even greater urgency are given increasing priority levels from 3 and up.

To distribute regular packages at the default priority level of 5, and then assign a priority level of 4 or another lower priority level for packages that can be held back due to their size, or for other reasons.

2.26.3 Change priority function

You can change the priority of distributed packages when executing package distribution jobs using Remote Install Manager.

The following table describes the change priority function settings.

Setting

Description

Application

Configurable values

Default value

Priority

Specifies the priority of a package.

Packages

1 to 9

5

In addition to packages packaged using the Windows agent Packager, you can also change shared packages packaged with the UNIX or Mac agent. Note that shared packages are not assigned a priority level, and are treated as having the default priority level of 5.

The following table describes the packages with priority levels that can be changed.

Packager used for packaging

Priority changes

Initial priority level shown on screen used to apply changes

13-00 version of the Windows agent

Possible

Priority specified by Packager

12-60 and earlier versions of the Windows agent

Possible

Default (5)

UNIX or Mac agent (shared packages)

Possible

Default (5)

UNIX or Mac agent (other than shared packages)

Not possible

Default (5), inactive

2.26.4 Agent settings

You can configure general priority distribution settings for the agent.

The following table describes the agent settings to be configured.

Setting

Description

Configurable values

Default value

Function option

Specifies whether to enable the priority distribution function.

Enable or disable

Disable

Job confirmation interval

Specifies the interval between checks on whether distribution jobs are being executed.

(Unit: Minutes)

1 to 1440

5

Priority distribution is disabled by default. The default job confirmation interval is set to 5 minutes in order to quickly detect high priority packages. For a more immediate response, you can set this to the minimum setting of 1 minute, as with polling.

3 About Product Licenses

This chapter describes JP1/IT Desktop Management 2 product licenses.

3.1 Overview of product licenses

JP1/IT Desktop Management 2 uses the node count license method to manage the number of used licenses. This method uses one license for a managed device regardless of the type of the device. This means that as many devices as the number of licenses registered on JP1/IT Desktop Management 2 can be managed. Device imported from management relay server and Microsoft Intune do not use licenses. Note that licenses are used for device management only, and not used for asset management.

Use the product edition license key file, which is provided when JP1/IT Desktop Management 2 is purchased, to register a license. If the number of used licenses matches the number of registered licenses, no more devices can be added. Therefore, register a sufficient number of licenses in advance.

If you want to manage more devices than you have registered licenses for, you need to add licenses. To add a product license, purchase a license and then register it.

When automatic registration during a search adds more management targets than there are licenses for, the devices are handled as discovered devices. Although the discovered devices are displayed in the view displayed by selecting Discovery, and then Discovered Nodes in the Settings module, they are not management targets (no licenses are used). Because the devices cannot be changed to management targets, operations such as the acquisition of device information and the judgment of the security status cannot be performed. If a managed device is changed to an exclusion target or is deleted, the number of used licenses changes.

Tip

In a multi-boot environment, each OS is handled as a different device because information reported to the management server differs depending on the OS.

Tip

For the number of licenses of JP1/IT Desktop Management 2, the total number of registered licenses (the total of licenses for Windows, Linux, and UNIX agents, if registered) is displayed in the License Information section in the System Summary panel. Clicking the value displayed in the License Information section displays the total number of licenses and its breakdown (for Linux and for UNIX). Note that the difference obtained by subtracting the number of licenses for UNIX and Linux from the total number of licenses includes both licenses for Windows and those for Mac OS. For example, if the total number of licenses is 150 and the number of licenses for UNIX and Linux is 50, the difference obtained by subtracting 50 from 150 (i.e., 100 licenses) includes both licenses for Windows and those for Mac OS.

Tip

To manage the Citrix XenApp and Microsoft RDS server, in addition to licenses to manage servers, you need as many licenses as the number of accounts of users of Citrix XenApp and Microsoft RDS.

Note that you do not need to count the accounts that the administrators of the Citrix XenApp and Microsoft RDS server use as the number of accounts of users of Citrix XenApp and Microsoft RDS.

Tip

The required number of licenses to manage shared VDI-based virtual computers is as follows:

When VMware Horizon View or the MCS (Machine Creation Services) technology provided by Citrix Virtual Desktops is used:

As many licenses as the number of virtual computers

When the PVS (Provisioning Services) technology provided by Citrix Virtual Desktops is used:

As many licenses as the number of user accounts using virtual computers

Tip

When you use Microsoft Intune as a MDM system, you do not consume licensing for device that you manage with Microsoft Intune. However, among devices managed by Microsoft Intune, if the Agent is installed on a PC with a Windows OS, the license of the device will be consumed.

Tip

Devices whose host ID begin with "#IT" are devices imported from Microsoft Intune. In device list window, you can search for device imported from Microsoft Intune by specifying the filter criteria (host ID (partial-match), including all, and #IT).

Tip

When you use Google Workspace as a MDM system, you do not consume licensing for device that you manage with Google Workspace.

3.2 Relationship between device status and product license

If a discovered device is added as a management target or if a managed device is excluded from management, the number of used product licenses changes. The following table describes the device statuses and whether a product license is required.

Device status

Product license

Description

Discovered

No

The device is discovered by the network search or network monitoring function.

Managed

Yes

The device is to be managed as a target of device management, security control, and asset management. The managed device is subject to operations performed from the management server and report display.

Ignored

No

The device is excluded from the management. Any device that does not need to be managed must be in the Ignored status.

Legend: Yes: Used, No: Not used

To add a device as a management target of JP1/IT Desktop Management 2, set the device status to Managed. If you set the device status to Managed, a product license is used. A device whose status is Discovered or Ignored does not use a product license. If you change the status of a device from Managed to Ignored, the product license used for that device can be used for another device.

3.3 Managing product licenses in a multi-server configuration

In a multi-server configuration, the primary management server manages all the product licenses. Product licenses are not required for managing management relay servers.

If you want to manage the number of licenses that are held or the remaining number of licenses on each management server, you must configure the product license information on the management relay servers from the primary management server. The following sections describe how to configure product license information on a management relay server.

About license holding options

You can select a license holding option when you configure product license information on a management relay server. After a license holding option is specified, the management relay server can manage product licenses in the same manner as the primary management server. The primary management server and management relay servers with a license holding option specified are collectively called the management servers for holding licenses.

You can specify either of the following license holding options on a management relay server:

Distribution from primary management server

If this license holding option is specified, some of the product licenses registered on the primary management server are distributed to the management relay server. Specify this option when you want to limit the number of devices that can be managed for each range of shared licenses. The range of shared licenses is described later.

License registration

If this license holding option is specified, the management relay server is authorized to register licenses. Specify this option if you want to manage product licenses by purchasing and registering them for each management relay server.

Tip

In a multi-server configuration, only the primary management server and management relay server authorized by the primary management server can register product licenses.

About ranges of shared licenses

If you configure product license information on a management relay server, a range of shared licenses is automatically formed. The following figure shows an example configuration of the ranges of shared licenses:

A range of shared licenses consists of a sharing source (management server for holding licenses) and a sharing destination (management relay server that does not hold licenses). A sharing destination forms a range of shared licenses with the sharing source on the nearest higher level. In the figure above, management relay server B forms the range of shared licenses 1 with primary management server A, which is a sharing source on the nearest higher level. Likewise, management relay server E forms the range of shared licenses 3 with management relay server C. Management relay server D, which does not have any lower management relay servers, forms the range of shared licenses 2 on its own.

In a range of shared licenses, the number of licenses held by the sharing source is the number of devices that can be managed. In the figure above, the range of shared licenses 1 can manage 100 devices regardless of which management server manages the devices. Similarly, the range of shared licenses 2 can manage 10 devices, and the range of shared licenses 3 can manage 40 devices.

Checking the information on the range of shared licenses

You can check license information including the number of held licenses, number of used licenses, and number of remaining licenses, on the primary management server or on the sharing source of each range of shared licenses. On the primary management server, you can check information on all the ranges of shared licenses. On the sharing source of each range of shared licenses, you can check information on the range of shared licenses to which the local server belongs.

The information on the range of shared licenses is displayed in the License Information sections in the License Details dialog box and in the License Details view (under Product Licenses) of the Settings module.

Tip

You might want to investigate the total number of devices discovered by the management servers in order to check the number of licenses that are lacking in a range of shared licenses. In this case, you can filter the list in the Discovery - Discovered Nodes view of the Settings module by Managing Source. Specify the host names of the management servers in the range of shared licenses in Managing Source, and check the number of devices that match the filter condition.

Related Topics:

3.3.1 Distributing product licenses to management relay servers

3.3.2 Authorizing license registration for management relay servers

3.3.1 Distributing product licenses to management relay servers

In a multi-server configuration, some of the product licenses registered on the primary management server can be distributed to management relay servers. Distribute the product licenses to management relay servers if you want to limit the number of manageable devices within each range of shared licenses. To distribute product licenses to a management relay server, execute the distributelicense command to configure product license information on the management relay server.

Note that you cannot distribute a product license to a management relay server on which a product license has already been registered. You cannot distribute product licenses that are already registered in a management relay server to another management relay server.

After product licenses are distributed, ranges of shared licenses are automatically formed. The number of licenses held in the range of shared licenses whose sharing source is the primary management server is equal to the total number of licenses on the primary management server subtracted by the number of licenses that have been distributed to management relay servers. The number of licenses held in the range of shared licenses whose sharing source is the distribution-target management relay server is equal to the number of licenses distributed from the primary management server.

The following figure shows an example configuration of ranges of shared licenses, and product license information in each range of shared licenses when product licenses are distributed.

Tip

The product licenses on the primary management server can be re-distributed any number of times. In the following cases, re-distribute the product licenses to each management relay server.

You want to change the ranges of shared licenses

You have registered additional product licenses on the primary management server in order to address the lack of licenses in a range of shared licenses.

Related Topics:

3.3 Managing product licenses in a multi-server configuration

3.3.2 Authorizing license registration for management relay servers

3.3.2 Authorizing license registration for management relay servers

In a multi-server configuration, provided that authorization from the primary management server is granted, you can register product licenses on any management relay server. Authorize product license registration for a management relay server if you want to manage product licenses by purchasing and registering them for each management relay server. To authorize product license registration for a management relay server, execute the distributelicense command to configure product license information on the management relay server.

Important

After a product license is registered on a management relay server, you will not be able to distribute product licenses from the primary management server to the management relay server and management relay servers under it. Therefore, carefully consider the ranges of shared licenses before authorizing product license registration for a management relay server.

Once product license registration is authorized, ranges of shared licenses are automatically formed. The number of licenses held in the range of shared licenses whose sharing source is the primary management server is equal to the total number of licenses on the primary management server subtracted by the number of licenses distributed to the management relay servers. The number of licenses held in the range of shared licenses whose sharing source is the management relay server for which product license registration has been authorized is equal to the number of licenses you have registered on the management relay server.

The following figure shows an example configuration of ranges of shared licenses, and product license information in each range of shared licenses when product license registration is authorized.

3.4 Cautions about product licenses

Product licenses can be used only on the management server on which they have been registered and management relay servers to which they have been distributed, and cannot be used on any other computer.

4 System Design

System design for JP1/IT Desktop Management 2 requires the examination of the system configuration, the system operation methods, and an estimate of system requirements.

This chapter provides an overview of how to design a JP1/IT Desktop Management 2 system and start operation. This chapter also describes the issues that must be examined during system design.

For details on system design when you utilize Remote Install Manager for distribution, see the description on system design in the JP1/IT Desktop Management 2 Distribution Function Administration Guide . For details on system design when you utilize Asset Console for asset management, see the description on system design in the JP1/IT Desktop Management 2 - Asset Console Configuration and Administration Guide.

4.1 Installation and operation procedure

This section describes the procedure for installation and operation of JP1/IT Desktop Management 2. To install JP1/IT Desktop Management 2, you must first design the system. During system design, determine the system configuration and operation methods. Then, set up the system and start operation. The following figure shows the procedure for installation and operation ofJP1/IT Desktop Management 2.

For details about the system design and system setup procedures, see 4.1.1 Installation procedure. For details about the system operation procedure, see 4.1.2 Operation procedure.

4.1.1 Installation procedure

To install JP1/IT Desktop Management 2, you must design a system configuration and set up an environment. The following describes the installation procedure for JP1/IT Desktop Management 2.

Examine the organization rules

Examine the security control rules for the organization. You can design, set up, and operate the JP1/IT Desktop Management 2 system based on the examination results.

Check the system prerequisites

Check the prerequisites for the servers and computers in the system. For details about checking the prerequisites, see 4.2 System prerequisites.

Examine the system configuration

Examine the system configuration considering the purpose of the system. For details about examining system configurations, see 4.4 Examining the system configuration.

Examine the functions to use

Confirm that the operating environment satisfies the prerequisites for the functions to be used. For details about the prerequisites for each function, see 4.3 Prerequisites for functions.

Analysis and preparation before operation

Examine the system operation methods, including the devices to be managed and the operation schedule. For details about examining operation methods, see 4.6 Analysis and Preparation before operation.

Examine the database

Consider what database size is appropriate for the operation method. For details about examining a database, see 4.5 Examining the database.

Estimate the system requirements

Based on the results in steps 1 to 6, estimate the requirements of the system. For details about estimating system requirements, see A.6 Performance and Estimates.

For details about the system operation procedure, see 4.1.2 Operation procedure.

4.1.2 Operation procedure

After setting up an environment, you can operate the system as determined during system design. The following describes the operation procedure for the JP1/IT Desktop Management 2 system.

Specify the settings required for operation

Use the operation windows of JP1/IT Desktop Management 2 to specify the search schedule and search range for devices and the security policy based on the results of the examination performed before operation.

Collect device information

Search for devices from the management server to automatically collect the latest IT device information. If necessary, install agents on the computers.

Monitor and control the network

Monitor the network for any new computers connected, and prevent unauthorized computers or computers with insufficient security measures from connecting to the network.

Determine and diagnose security status

Confirm that the computers observe the predefined security policy to check for any computers with insufficient security measures. JP1/IT Desktop Management 2 can output a report containing the collected information that you can use to diagnose security status.

Take security measures

Take security measures based on the diagnostic results. If you need to review the policy, return to step 1 and change the security policy.

Manage asset information

Manage all information about the assets owned by the organization, including the devices, software licenses, and contracts. You can keep track of the usage status of hardware assets and software licenses, and check the resources' contract information and costs.

4.2 System prerequisites

This section describes the prerequisites for the network and system components, including the management server installed in the system, and the computers on which agents are installed.

For details about memory requirements, disk space requirements, and available CPUs, see A.6 Performance and Estimates.

Related Topics:

4.2.1 Management server prerequisites

4.2.3 Prerequisites for a computer on which an agent will be installed

4.2.7 Prerequisites for a computer on which the network monitor is enabled

4.2.5 Prerequisites for a computer on which the controller will be installed

4.2.10 Network prerequisites

4.2.1 Management server prerequisites

The following describes the OSs and software required for the management server.

Note that you can use only alphanumeric characters and hyphens (-) for the computer name of the server on which JP1/IT Desktop Management 2 - Manager is installed. Also note that the computer name must begin with an alphabetic character and end with an alphanumeric character.

OSs

The management server requires one of the OSs listed in the following table.

OS

Details

Windows Server 2019#

Windows Server 2019 Datacenter

Windows Server 2019 Standard

Windows Server 2016#

Windows Server 2016 Datacenter

Windows Server 2016 Standard

Windows Server 2012#

Windows Server 2012 Datacenter

Windows Server 2012 R2 Datacenter

Windows Server 2012 Standard

Windows Server 2012 R2 Standard

#: Server Core cannot be used as an installation option.

Software

Windows Installer 2.0 or later must be installed on the server on which JP1/IT Desktop Management 2 - Manager is to be installed.

Related Topics:

A.6 Performance and Estimates

4.2.2 Prerequisites for an administrator's computer

The following describes the software required for using the operation windows and OS, and the software required to install Remote Install Manager. For prerequisites required to use the computer as a controller, see 4.2.5 Prerequisites for a computer on which the controller will be installed.

Remote Install Manager and JP1/IT Desktop Management 2 - Agent (relay system) cannot be installed on the same computer.

Software required for using the operation windows

The following table lists the software required to use the operation windows of JP1/IT Desktop Management 2.

Item

Software

Web browser

One of the following is required:

Windows Internet Explorer 11

Firefox ESR 60 or later

Google Chrome 78 or later

Microsoft Edge

OSs required to install Remote Install Manager

A computer on which Remote Install Manager will be installed requires one of the OSs listed in the following table.

OS

Details

Windows 2019#1

Windows Server 2019 Datacenter

Windows Server 2019 Standard

Windows 2016#1

Windows Server 2016 Datacenter

Windows Server 2016 Standard

Windows 10

Windows 10 Enterprise

Windows 10 Pro

Windows 8.1

Windows 8.1

Windows 8.1 Enterprise

Windows 8.1 Pro

Windows 8

Windows 8

Windows 8 Enterprise

Windows 8 Pro

Windows Server 2012#1

Windows Server 2012 Datacenter

Windows Server 2012 R2 Datacenter

Windows Server 2012 Standard

Windows Server 2012 R2 Standard

Windows 7#2

Windows 7 Enterprise#3

Windows 7 Professional#3

Windows 7 Ultimate#3

#1

Server Core cannot be used as an installation option.

#2

XP mode is not supported.

#3

Service Pack 1 is included.

To install Remote Install Manager on a computer different from the management-server-installed computer, the version of Remote Install Manager and the version of JP1/IT Desktop Management 2 - Manager on the management server must be the same.

Software required to install Remote Install Manager

Windows Installer 2.0 or later

Note that the computer name of the server on which Remote Install Manager is installed can only contain single-byte alphanumeric characters and hyphens (-). The first character of the computer name must be a single-byte letter, and the last character a single-byte alphanumeric character.

Related Topics:

A.6 Performance and Estimates

4.2.3 Prerequisites for a computer on which an agent will be installed

This section describes OSs and software prerequisite for computers on which an agent will be installed.

Note that you cannot install an agent on a management relay server. An agent for the management relay server is automatically installed on a management relay server.

OS

A computer on which an agent will be installed requires one of the OSs listed in the following table.

OS

Description

Windows Server 2019#3

Windows Server 2019 Datacenter

Windows Server 2019 Standard

Windows Server 2016#3

Windows Server 2016 Datacenter

Windows Server 2016 Standard

Windows 10

Windows 10 Enterprise

Windows 10 Pro

Windows 8.1

Windows 8.1

Windows 8.1 Enterprise

Windows 8.1 Pro

Windows 8#1, #2

Windows 8

Windows 8 Enterprise

Windows 8 Pro

Windows Server 2012#3

Windows Server 2012 Datacenter

Windows Server 2012 R2 Datacenter

Windows Server 2012 Standard

Windows Server 2012 R2 Standard

Windows 7#2, #4, #5

Windows 7 Enterprise

Windows 7 Home Basic#6

Windows 7 Home Premium

Windows 7 Professional

Windows 7 Starter

Windows 7 Ultimate

Windows Server 2008 R2#3

Windows Server 2008 R2 Datacenter#5

Windows Server 2008 R2 Enterprise#5

Windows Server 2008 R2 Standard#5

Linux#7

CentOS

CentOS 6

CentOS 7

CentOS 8.1

Red Hat Enterprise Linux Server

Red Hat Enterprise Linux(R) 5 (x86)

Red Hat Enterprise Linux(R) 5 (AMD/Intel 64)

Red Hat Enterprise Linux(R) 5 Advanced Platform (x86)

Red Hat Enterprise Linux(R) 5 Advanced Platform (AMD/Intel 64)

Red Hat Enterprise Linux(R) Server 6 (32-bit x86)

Red Hat Enterprise Linux(R) Server 6 (64-bit x86_64)

Red Hat Enterprise Linux(R) Server 7

Red Hat Enterprise Linux(R) Server 8

Oracle Linux

Oracle Linux 6

Oracle Linux 7

Oracle Linux 8

UNIX#7

AIX#7

AIX V6.1

AIX V7.1

AIX V7.2

AIX V7.3

Solaris#7

Solaris 10 (SPARC)

Solaris 11 (SPARC)

HP-UX#7

HP-UX 11i V3 (IPF)

Mac

Mac OS

OS X 10.10

OS X 10.11

macOS 10.12

macOS 10.13

macOS 10.14

macOS 10.15

macOS 11

macOS 12

macOS 13

macOS 14

macOS 15

#1: Not supported when Windows To Go is used.

#2: When you install an agent, connect to the local console and then perform the installation.

#3: Server Core cannot be used as an installation option.

#4: XP mode is not supported.

#5: Service Pack 1 is included.

#6: Only Chinese (Simplified) is supported.

#7: Can collectively be described as UNIX. For details on prerequisite programs and other preconditions for installing an agent, see the JP1/IT Desktop Management 2 - Agent Description and User's Guide (For UNIX Systems).

Important

You must start the Workstation service for the OS. In an environment in which this service has stopped, the security level determined based on the security policy is displayed as Unknown because OS account information cannot be acquired.

Important

Language settings in Windows

Before you install the product, make sure that all the language settings are consistently set to one language (Japanese, English, or Chinese (Simplified)), and then install the product.

Do not change the above language settings after the installation is completed.

The display language on the screen

The JP1/IT Desktop Management 2 screens can be viewed on native screens (Installer window, Agent window, and Command). The display language of native screens inherits the language settings of a Windows computer that displays each native screen.

Software

The following table shows the software required for a computer on which an agent will be installed.

Item

Software

Web browser

One of the following is required:

Windows Internet Explorer 9

Windows Internet Explorer 10

Windows Internet Explorer 11

Microsoft Edge

Google Chrome

Citrix XenApp and Microsoft RDS server

The tables below describe the OS requirements and the supported Citrix XenApp series that are applicable when you want to install an agent on the server on which Citrix XenApp and Microsoft RDS have been installed and manage it with JP1/IT Desktop Management 2.

OS

OS

Description

Windows Server 2019

Windows Server 2019 Datacenter

Windows Server 2019 Standard

Windows Server 2016

Windows Server 2016 Datacenter

Windows Server 2016 Standard

Windows Server 2012

Windows Server 2012 Datacenter

Windows Server 2012 R2 Datacenter

Windows Server 2012 Standard

Windows Server 2012 R2 Standard

Windows Server 2008 R2#

Windows Server 2008 R2 Datacenter

Windows Server 2008 R2 Enterprise

Windows Server 2008 R2 Standard

# Only Service Pack 1 is supported.

Citrix XenApp

Product

Version

Citrix XenApp#1, #2, #3

7.5, 7.6, 7.7, 7.8, 7.9, 7.11, 7.12, 7.13, 7.14

#1: Long Term Service Release is not supported.

#2: Only Screen Transfer Type of published desktops and published applications is supported.

#3: Machine Creation Services and Provisioning services are not supported.

No more than 60 users can be logged in to Citrix XenApp and Microsoft RDS at a time.

Shared VDI-based virtual computers

The table below describes the virtualization products that are supported when shared VDI-based virtual computers have agents installed on them and are managed by JP1/IT Desktop Management 2.

Virtualization Products

Product

Version

VMware Horizon View

7, 8(2006)

Citrix Virtual Desktops

1906

Related Topics:

A.6 Performance and Estimates

4.2.4 Prerequisites for a computer on which a relay system will be installed

The following describes prerequisites for a computer on which a relay system will be installed.

JP1/IT Desktop Management 2 - Agent (relay system) and Remote Install Manager cannot be installed on the same computer.

Important

The relay system cannot be used when using power saving functions such as standby, hibernation, sleep, or power on/off functions.

OS

A computer on which a relay system will be installed requires one of the OSs listed in the following table.

OS

Details

Windows Server 2019#1, #2

Windows Server 2019 Datacenter

Windows Server 2019 Standard

Windows Server 2016#1, #2

Windows Server 2016 Datacenter

Windows Server 2016 Standard

Windows 10

Windows 10 Enterprise

Windows 10 Pro

Windows 8.1#1

Windows 8.1

Windows 8.1 Enterprise

Windows 8.1 Pro

Windows 8#3

Windows 8

Windows 8 Enterprise

Windows 8 Pro

Windows Server 2012#2

Windows Server 2012 Datacenter

Windows Server 2012 R2 Datacenter#1

Windows Server 2012 Standard

Windows Server 2012 R2 Standard#1

Windows 7#4#5

Windows 7 Enterprise

Windows 7 Professional

Windows 7 Ultimate

#1: Operation in an environment with OneDrive is not supported.

#2: Server Core cannot be used as an installation option.

#3: Not supported when Windows To Go is used.

#4: XP mode is not supported.

#5: Service Pack 1 is included.

Important

You must start the Workstation service for the OS. In an environment in which this service has stopped, the security level determined based on the security policy is displayed as Unknown because OS account information cannot be acquired.

Software

The following table lists software required for a computer on which a relay system will be installed.

Item

Software

Web browser

One of the following is required:

Windows Internet Explorer 9

Windows Internet Explorer 10

Windows Internet Explorer 11

Microsoft Edge

Google Chrome

Related Topics:

A.6 Performance and Estimates

4.2.5 Prerequisites for a computer on which the controller will be installed

A computer on which the controller will be installed requires one of the OSs listed in the following table.

OS

Details

Windows Server 2019#1, #2

Windows Server 2019 Datacenter

Windows Server 2019 Standard

Windows Server 2016#1, #2

Windows Server 2016 Datacenter

Windows Server 2016 Standard

Windows 10

Windows 10 Enterprise

Windows 10 Pro

Windows 8.1#1

Windows 8.1

Windows 8.1 Enterprise

Windows 8.1 Pro

Windows 8#3

Windows 8

Windows 8 Enterprise

Windows 8 Pro

Windows Server 2012#2

Windows Server 2012 Datacenter

Windows Server 2012 R2 Datacenter#1

Windows Server 2012 Standard

Windows Server 2012 R2 Standard#1

Windows 7#4

Windows 7 Enterprise#5

Windows 7 Home Premium#5

Windows 7 Professional#5

Windows 7 Starter#5

Windows 7 Ultimate#5

Windows Server 2008#2

Windows Server 2008 R2 Datacenter#5

Windows Server 2008 R2 Enterprise#5

Windows Server 2008 R2 Standard#5

#1: Operation in an environment with OneDrive is not supported.

#2: Server Core cannot be used as an installation option.

#3: Not supported when Windows To Go is used.

#4: XP mode is not supported.

#5: Service Pack 1 is included.

Related Topics:

A.6 Performance and Estimates

4.2.6 Prerequisites for a computer on which to install an Internet gateway

This subsection describes the prerequisites for the computer on which to install an Internet gateway.

To install an Internet gateway, you need either JP1/IT Desktop Management 2 - Agent (relay system) or JP1/IT Desktop Management 2 - Agent.

OS

A computer on which an Internet gateway will be installed requires one of the OSs listed in the following table.

OS

Details

Windows Server 2022#1, #2

Windows Server 2022 Datacenter

Windows Server 2022 Standard

Windows Server 2019#1, #2

Windows Server 2019 Datacenter

Windows Server 2019 Standard

Windows Server 2016#1, #2

Windows Server 2016 Datacenter

Windows Server 2016 Standard

Windows Server 2012#2

Windows Server 2012 Datacenter

Windows Server 2012 R2 Datacenter#1

Windows Server 2012 Standard

Windows Server 2012 R2 Standard#1

#1: Operation in an environment with OneDrive is not supported.

#2: Server Core cannot be used as an installation option.

Software

The following table lists software required for a computer on which an Internet gateway will be installed.

Item

Software

Web server

One of the following is required:

Microsoft Internet Information Services 8.0

Microsoft Internet Information Services 8.5

Microsoft Internet Information Services 10.0

Related Topics:

A.6 Performance and Estimates

4.2.7 Prerequisites for a computer on which the network monitor is enabled

A computer on which the network monitor is enabled requires one of the OSs listed in the following table.

OSs

OS

Details

Windows Server 2019#1, #2

Windows Server 2019 Datacenter

Windows Server 2019 Standard

Windows Server 2016#1, #2

Windows Server 2016 Datacenter

Windows Server 2016 Standard

Windows 10

Windows 10 Enterprise

Windows 10 Pro

Windows 8.1#1

Windows 8.1 Enterprise

Windows 8.1 Pro

Windows 8

Windows 8 Enterprise

Windows 8 Pro

Windows Server 2012#2

Windows Server 2012 Datacenter

Windows Server 2012 R2 Datacenter#1

Windows Server 2012 Standard

Windows Server 2012 R2 Standard#1

Windows 7#3

Windows 7 Enterprise#4

Windows 7 Professional#4

Windows 7 Ultimate#4

#1: Operation in an environment with OneDrive is not supported.

#2: Server Core cannot be used as an installation option.

#3: XP mode is not supported.

#4: Service Pack 1 is included.

Software

An online management agent or a relay system must be installed.

Network environment

The IP address must be fixed.

The computer cannot have multiple IP addresses in the same network segment.

The MAC address must be fixed.

Related Topics:

4.2.3 Prerequisites for a computer on which an agent will be installed

A.6 Performance and Estimates

4.2.8 Prerequisites for agentless management

When using agentless management, setup must be completed on both the management server and user computer to collect device information. The range of information that can be acquired depends on the authentication method. The range of information that can be acquired depends on the authentication method. A limited range of information may result in unknown security states and missing data in reports, causing risks to system operation. Select the best authentication method for your security needs.

Setup to collect most of the available device information is easy if you are using Active Directory to manage the computers in your organization. If you are thinking of using agentless management, first make sure that your computers are managed in Active Directory.

For differences between the types of device information that can be collected, see 2.6.2 Collecting device information.

Important

Agentless management is not supported in a NAT environment.

Important

Do not delete the discovery range or authentication information for any agentless managed device discovered in a network search. Likewise, do not delete the Active Directory setting for any agentless managed device discovered by an Active Directory search. Deleting this setting information prevents device information from being collected. If you mistakenly delete the discovery range, authentication information, or Active Directory setting, add them and then re-execute the network search or Active Directory search to discover the devices.

Important

In a DHCP environment, if a device's IP address changes, moving outside the discovery range, no information will be collected about that device.

When using Windows administrative shares to perform agentless management

All the following conditions must be satisfied:

Windows firewall is disabled on the user's computer#1.

Simple file sharing is disabled on the user's computer.

File and Printer Sharing is enabled on the user's computer.

Windows Administrative Share (ADMIN$) is enabled on the user's computer.

Access to the Interprocess Communications share (IPC$) is enabled on the user's computer.

The information used for logging in to the target computer by using Windows administrative shares is set on the management server as authentication information for network searches.#2

#1: Even if Windows Firewall is enabled, the condition is still satisfied if TCP (port 445) is open for traffic.

#2: The authentication information for logging in to the target computer by using Windows administrative shares must satisfy either of the following conditions:

The built-in Administrator account and password of the user's computer is used.

The UAC function is disabled on the user's computer.

How to make Windows administrative shares accessible to a management server varies depending on the OS on the user's computer. The following settings are required to make Windows administrative shares accessible:

OS

Setting

Windows 10

Disable UAC or enable the Administrator account.#1

Enable File and Printer Sharing in the Network and Sharing Center window.

Windows 8.1

Windows 8

Windows 7

Windows Vista

Disable UAC or enable the Administrator account.

Enable File sharing in the Network and Sharing Center window.

Windows XP#2

Disable simple file sharing.

Add file shares.

Windows Server 2019

Enable File sharing or File and Printer Sharing in the Network and Sharing Center window.

Windows Server 2016

Windows Server 2012

Windows Server 2008

Windows Server 2003

Setup unnecessary (enabled by default).

Windows 2000

Add file shares.

Computer other than Windows

Not supported (cannot be configured).

Network device

Not supported (cannot be configured).

#1: If you are using Windows 8.1 or Windows 8 (no edition), perform this setup by executing the net user command at the command prompt. You cannot enable the Administrator account from the Windows Control Panel.

#2: In Windows XP Home Edition (Service Pack 2 and 3), Windows administrative shares cannot be used.

If these conditions are satisfied, you can acquire most of the available device information. The information collected hardly differs from that collected via agents installed on the managed computers.

When using SNMP to perform agentless management

The following conditions must be satisfied:

SNMP can be used.

The community name can be authenticated.

The following table describes the setup required to acquire device information using SNMP:

OS

Setting

Windows 10

Install an SNMP agent.

Set up the SNMP agent.

Windows 8.1

Windows 8

Windows 7

Windows Vista

Windows XP

Windows Server 2019

Windows Server 2016

Windows Server 2012

Windows Server 2008

Windows Server 2003

Windows 2000

Computer other than Windows

Network device

When using Active Directory to perform agentless management

Both the following conditions must be satisfied:

Windows firewall is disabled on the user's computer.#

Using the Active Directory linkage feature, the management server can acquire device information managed by Active Directory.

#: If Windows firewall is enabled, the condition is still satisfied if connection via a port number specified in Active Directory settings view accessed from General view in the Settings module is open for traffic.

When using ICMP to perform agentless management

ICMP must be available for use.

The following table describes the setup required to acquire device information using ICMP:

OS

Setting

Windows 10

Allow incoming ICMP echo requests.#

Windows 8.1

Windows 8

Windows 7

Windows Vista

Windows XP

Windows Server 2019

Windows Server 2016

Windows Server 2012

Windows Server 2008

Windows Server 2003

Windows 2000

Computer other than Windows

Network device

#: In Windows XP or later, you must configure the Windows Firewall to allow ICMP traffic or disable Windows Firewall.

Related Topics:

(1) Types of device information you can collect

(2) Device status information that can be collected

(3) System information that can be collected

(4) Hardware information

(5) Installed software information

(6) Security information

(7) Shared management items for asset information and device information

4.2.9 Prerequisites for linking with JP1/IM

The following shows the software required for linking with JP1/IM.

JP1/IM 10-00 or later, or Job Management Partner 1/IM 10-00 or later

JP1/Base 10-00 or later, or Job Management Partner 1/Base 10-01 or later

The required OSs are the same as for JP1/Base.

4.2.10 Network prerequisites

The following describes the prerequisites for a network environment in whichJP1/IT Desktop Management 2 is installed.

Important

Whether communication is possible across a NAT, WAN, or VPN depends on the environment. Therefore, verify that communication is possible beforehand.

Important

In a NAT environment, you can install an agent to manage a computer, but cannot perform operations for the agent, such as message notification or acquisition of the latest device information, whenever you want. If you attempt such operations, they are performed when a polling from the agent occurs.

Entire network

Use a static IP address for the global IP address of the management server.

In addition, the TCP protocol ports used by JP1/IT Desktop Management 2 andJP1/IT Desktop Management 2 - Agent must be set up to accept incoming traffic. For details about the port numbers, see A.3 Port number list.

Network connection environment

The following describes the network connection environment for each system component.

For the management server:

The server must be connected to a wired LAN network.

For a computer on which the network monitor is enabled:

The computer must be connected to a wired LAN or a wireless LAN network. Note, however, that if the communication environment has been degraded, it might not be possible to block devices connected to a wireless LAN from the network. Therefore, we recommend that you connect the computer to a wired LAN network.

For a computer on which an agent has been installed:

The computer must be connected to a wired LAN, wireless LAN, WAN, or VPN network. Note, however, that devices connected to a wireless LAN cannot be turned off by using the power-off function. For details about power control, see 2.6.3 Controlling devices.

For an agentless computer:

The computer must be connected to a wired LAN, wireless LAN, WAN, or VPN network.

Network between the management server and managed computers

ICMP communication from the managed computers to the management server is required for optimum operation.

If ICMP communication from the management server to the managed computers is not possible, any operation attempted from the management server for a managed computer (such as software installation, message notification, and acquisition of the latest device information) is performed when a polling from the agent occurs.

Tip

In a DHCP environment, even if an IP address is dynamically assigned to the computer, the same IP address will not be registered twice in JP1/IT Desktop Management 2.

Network between the management server and computers used for window operations

To use the operation windows of JP1/IT Desktop Management 2 on a computer other than the management server, an environment that allows HTTP communication via a Web browser is required.

Network with the Windows Firewall set

The following describes the settings required for each system component.

For the management server:

WhenJP1/IT Desktop Management 2 is installed in an environment in which the Windows firewall is enabled, the program is automatically allowed to pass the Windows firewall (registered as a firewall exception).

However, if the program was installed in an environment in which the Windows firewall was disabled, the program is not allowed to pass the firewall even if the Windows Firewall is subsequently enabled. In this case, execute the addfwlist.bat command on the management server to allow communication through the Windows Firewall. The executable file of the command is stored in the following folder.

JP1/IT Desktop Management 2 - Manager installation folder\mgr\bin\

For a computer on which the controller is installed:

When the controller is installed, it is automatically registered as a firewall exception. So, it can pass through the Windows firewall no matter whether the Windows firewall is enabled or disabled. No additional settings are required.

For a computer on which the agent is installed:

When the agent is installed, it is automatically registered as a firewall exception. So, it can pass through the Windows firewall no matter whether the Windows firewall is enabled or disabled. No additional settings are required.

For an agentless computer:

Add the TCP port (port number 445) to the Windows firewall exception list.

Related Topics:

4.2.8 Prerequisites for agentless management

4.3 Prerequisites for functions

Related Topics:

4.3.1 Device management prerequisites

4.3.2 Network monitor prerequisites

4.3.3 Prerequisites for remote control

4.3.4 Security control prerequisites

4.3.5 Prerequisites for acquiring operation logs

4.3.6 Asset management prerequisites

4.3.7 Prerequisites for the distribution function

4.3.8 Prerequisites for reports

4.3.1 Device management prerequisites

Device management requires the management target devices to be connected to the network. To display devices in an operation window of JP1/IT Desktop Management 2, they must be added as management targets by using one of the following methods.

Install the agent on the computer (the devices are automatically added as management targets).

Perform a device search and then add the discovered devices as management targets.

Use network monitoring and then add the discovered devices as management targets.

When you add a device that uses both IPv4 and IPv6 IP addresses as a management target, use only the IPv4 addresses.

Devices having only IPv6 IP addresses can be added as the management targets by only searching for devices registered in Active Directory. In this case, however, you can manage only the existence of the devices.

Related Topics:

4.2.3 Prerequisites for a computer on which an agent will be installed

4.3.2 Network monitor prerequisites

Installing the network monitor requires a computer that monitors the network. Provide one online managed computer for each network segment in which you want to install the network monitor, and then enable the network monitor on that computer.

In addition, do not clear the following check boxes in the Basic settings in the agent configurations assigned to the computer that monitors the network.

Communicate with the higher system

Periodically notify the higher system of the information collected from the computer.

The network monitor takes effect as long as the agent is running. Therefore, the computer with the network monitor enabled must be running during the time that you want to monitor the network.

Tip

We recommend that you enable the network monitor on a 24-hour computer to consistently monitor the network.

Important

A computer that monitors the network (online managed computer with the network monitor enabled) accepts connections even from devices that have been blocked from the network due to, for example, insufficient security measures. Therefore, do not configure a mission-critical server, such as a file server, as the computer that monitors the network.

Important

On agents for UNIX or Mac , and Citrix XenApp, Microsoft RDS server the network monitor cannot be enabled. You must manually control network connections.

4.3.3 Prerequisites for remote control

The following describes the prerequisites needed to remotely control computers.

Prerequisites for the administrator's computer

The controller, which is a program that remotely controls other computers, must be installed on the administrator's computer. The controller accesses a window of a computer subject to remote control and allows the administrator to perform window operations.

When remote control is started in an operation window, the controller is automatically installed on the computer that displays the operation window.

Prerequisites for the connection destination computer

The conditions required for the connection destination computer vary depending on the method for connecting the controller.

Standard connection

The agent must be already installed and the remote control agent must be running. The remote control agent is a remotely controlled program, and provides the controller with a window on the controlled computer and performs operations in that window according to the instruction from the controller.

The remote control agent is part of the agent program. When the agent is installed, the remote control agent is also installed if you select the remote control agent in the Components to Install dialog box.

The remote control agent can be used in JP1/IT Desktop Management 09-50 or later or JP1/IT Desktop Management 2 10-50 or later.

RFB connection

The RFB connection allows the remote control function to be used in agentless mode, that is, without using the remote control agent. However, the RFB connection restricts the remote control function.

To use the RFB connection, one of the following conditions must be satisfied.

Software providing the VNC server function (for example, the following software) is running.

- Intel v Pro (if KVM Remote Control is available on a computer on which AMT 6.0 or later is installed)

- Realness

- Ultraviolet

- Firmware Workstation

The operating system is Mac OS X and Screen Sharing or Remote Management is enabled.

Important

Remote Control Agent and the following products that have the remote control functions cannot be used at the same time when both are installed on the same computer. Disconnect one remote control connection before connecting the other.

JP1/Remote Control Agent

JP1/NETM/Remote Control Agent

The following Remote Control Agent components included in JP1/NETM/DM Manager:

JP1/NETM/DM Client - Remote Control Feature

Remote Control Agent included in JP1/NETM/DM Client

JP1/NETM/Remote Control Agent for Blade PC#

Other remote control products

#: This product is provided as part of Secure Client Solution.

Important

For remote control using the RFB connection, operation is not always guaranteed because a controlled computer might be configured by using free software. Some functions might not be available. Therefore, we recommend that you use a trial version in advance to confirm and verify operation. Note that we do not support any questions about environment setup, specifications, setting methods, and errors related to the controlled hardware or programs using the RFB connection.

Important

The remote control function of JP1/Remote Control,JP1/Remote Control, or JP1/Software Control cannot be connected to.

Important

You cannot install the controller on a computer running UNIX or Mac operating system. An agent for UNIX or Mac does not include the remote control agent, which is a program required on a remotely-controlled computer. Note that the remote control function can be used on a computer running Linux or Mac OS if the computer is connected by using RFB.

Important

On the Citrix XenApp and Microsoft RDS server, you cannot use a remote control agent.

Related Topics:

2.7.2 Remote control features

2.7.9 Using the remote control feature in NAT and DHCP environments

4.3.4 Security control prerequisites

To perform security control, an agent must be installed on each of the computers subject to security control. For offline managed computers, acquisition of device information must be completed.

The following describes the prerequisites to use the security control functions.

Prerequisites to manage the application of updated programs:

All the following conditions must be satisfied:

A support services contract has been made.

MSXML 4.0 Service Pack 2 or MSXML 6.0 is installed.

Prerequisites to determine whether anti-virus products are installed

There are no prerequisites to determine whether anti-virus products are installed.

To check whether anti-virus products are installed, you only have to check whether anti-virus products supported by JP1/IT Desktop Management 2 are installed on the target computer.

Tip

To check whether an anti-virus product not supported byJP1/IT Desktop Management 2 is installed, add that anti-virus product as mandatory software.

Prerequisites for using the suppression functions

Function

Prerequisites

Suppressing startup of the software

The combined length of the file name and folder name of the target software must be less than 260 characters.

Suppressing printing

In the properties for each printer, Print and Manage Documents must be allowed for all logged on users.#

# For the network shared printer, the following prerequisites are added.

The table below shows the supported combination of the agent and the print server.

Agent

Print server

Printing restriction

Windows 7 or later

Windows XP/2003

N

Windows 7 or later

Windows Vista or later

Y

Any

Others

N

Legend: Y:Printing can be restricted for this type of printer. N:Printing cannot be restricted for this type of printer.

RPC communication must be possible between the print server and the agent PC. If RPC communication is not possible, the problem might be caused by one of the following:

The print server is a server based on the Internet Printing Protocol (IPP).

A firewall, proxy or NAT is present between the print server and the agent PC.

The agent PC's Windows firewall is enabled and File and Printer Sharing is not set to Exceptions.

The agent PC's File and Printer Sharing for Microsoft Networks must be enabled.

The print server must be able to resolve the name of the agent PC.

If the agent PC is Windows 7 or later, the agent PC and the print server must join the same domain, or the credential of the print server must be registered on the Credential Manager of the agent PC. The agent PC needs to reboot after registering the credential.

For details about prerequisites for suppressing the use of devices, see (1) Devices whose use can be restricted.

Important

Agents for UNIX and Mac are not subject to security control. Therefore, application management of update programs (OS patches), determination on whether anti-virus products are installed, and use of the suppression functions are not available.

Related Topics:

(14) Supported anti-virus products

4.3.5 Prerequisites for acquiring operation logs

To acquire operation logs, the agent must be installed on the computer from which you want to acquire operation logs.

Prerequisites for acquiring an operation log vary depending on the log type, as described in the following table.

Operation log type

Prerequisites

Computer operation

Start and stop of the computer

--

Logon to and logoff from the OS

Start and termination of the programs

The combined length of the file name and folder name for logged programs must be less than 260 characters.

File and folder operation

File and folder operation in the computer

--

Upload to and download from the Web

Operation logs for the following Web browsers can be acquired:

Internet Explorer 9, 10, 11, and Microsoft Edge (IE mode)#1

If your Web browser is Internet Explorer 10 or 11, and Microsoft Edge (IE mode) the Enable third-party browser extensions check box must be selected on the Advanced Settings tab in the Internet Options dialog box. Note that this check box is cleared by default for Internet Explorer installed in Windows Server 2012 and Windows Server 2008 R2.

If your Web browser is Internet Explorer 10 or 11, the JP1/IT Desktop Management 2 FUO add-on must be enabled in the list of add-ons displayed by selecting Tools, Manage Add-ons, and then Toolbars and Extensions in Internet Explorer.

E-mail transmission and reception

Operation logs for the following e-mail clients can be acquired:

Microsoft Outlook 2002, 2003, 2007, 2010, 2013, 2016, and 2019

Windows Live Mail 2009, 2011, and 2012

Save of attached files

File transmission and reception

Operation logs for the following Web browsers can be acquired:

Internet Explorer 9, 10, and 11#1

Print operation

In the properties for each printer, Print and Manage Documents must be allowed for all logged on users.#2

Web access

Operation logs for the following Web browsers can be acquired:

Internet Explorer 9, 10, and 11, and Microsoft Edge (IE mode)#1

Microsoft Edge

Google Chrome

Internet Explorer has the following precautions:

The Enable third-party browser extensions check box must be selected on the Advanced Settings tab in the Internet Options dialog box of Internet Explorer. Note that this check box is cleared by default for Internet Explorer installed in Windows Server 2012 and Windows Server 2008 R2.

The add-on for Web access monitoring that is added to the user's computer must be enabled.

In addition, JP1/IT Desktop Management 2 BHO must be enabled in the list of add-ons displayed by selecting Tools, Manage Add-ons, and then Toolbars and Extensions in Internet Explorer.

Connection and disconnection of devices

--

Window operation

--

Legend: --: None

#1: Operation logs for Web upload, Wed download, file reception, and Web access can be acquired only for desktop Internet Explorer for which Enhanced Protected Mode is disabled.

For Microsoft Edge (IE mode), web upload and web access operation logs can be acquired only if Internet Explorer's Enhanced Protected Mode is disabled.

#2: For the network shared printer, the following prerequisites are added.

The table below shows the supported combination of the agent and the print server.

Agent

Print server

Collection of operation logs for print operations

Windows 7 or later

Windows XP/2003

N

Windows 7 or later

Windows Vista or later

Y

Any

Others

N

Legend: Y: Operation logs can be collected for this type of printer. N: Operation logs cannot be collected for this type of printer.

RPC communication must be possible between the print server and the agent PC. If RPC communication is not possible, the problem might be caused by one of the following:

The print server is a server based on the Internet Printing Protocol (IPP).

A firewall, proxy or NAT is present between the print server and the agent PC.

The agent PC's Windows firewall is enabled and File and Printer Sharing is not set to Exceptions.

The agent PC's File and Printer Sharing for Microsoft Networks must be enabled.

The print server must be able to resolve the name of the agent PC.

If the agent PC is Windows 7 or later, the agent PC and the print server must join the same domain, or the credential of the print server must be registered on the Credential Manager of the agent PC. The agent PC needs to reboot after registering the credential.

Important

Agents for UNIX and Mac are excluded from operation log collection.

Acquiring operation logs for Microsoft Edge (native)/Google Chrome

Prerequisites

It is assumed that the web browser is not in private mode.

Notes

When accessing the web in Edge's IE mode, the same operation logs will be acquired twice.

When deleting the browser cache or profile, some operation logs may not be acquired.

Acquiring operation logs for Command Prompt/PowerShell

Prerequisites

When acquiring PowerShell operation logs, it is assumed that Windows PowerShell version 5 or later is used.

Note: This prerequisite is met for client OSes with Windows 10 or later, and for server OSes with Windows Server 2016 or later.

4.3.6 Asset management prerequisites

Prerequisites for managing smart devices by linking with the MDM system

Asset management requires iOS, iPadOS or Android to be installed on the smart devices to be managed by linking with the MDM system.

To suppress the use of some USB devices based on the security policy, you need an online managed computer to register non-suppression target USB devices as assets.

Prerequisites for using information in the software dictionary

To use information in the software dictionary, you must have a support service contract in place, download the SAMAC software dictionary file for offline updates from the support service site, and update the dictionary file offline. Note that download of the SAMAC software dictionary file for offline updates is supported only in Japan.

Prerequisites for managing ChromeOS and ChromeOS Flex devices

For Asset management, you must use Google Workspace as MDM System. You also need Business or Education edition of Google Workspace.

Device Prerequisites OS is a ChromeOS or ChromeOS Flex.

4.3.7 Prerequisites for the distribution function

To use the distribution function, the agent must be installed on the distribution-target computer.

To install the software, the installer must be an MSI file or EXE file that supports silent installation.

4.3.8 Prerequisites for reports

Prerequisites for displaying a report vary depending on the report type, as described in the following table.

Report type

Prerequisites

Summary Reports

Daily Summary

The managed devices and asset information appropriate for the displayed information must be registered.

The number of days appropriate for the displayed period must have elapsed.

Weekly Summary

Monthly Summary

Security Diagnosis Reports

Current Diagnosis

The managed devices must exist.

The security policy settings must be enabled.

Timeframe Diagnosis

The managed devices must exist.

The security policy settings must be enabled.

The number of days appropriate for the displayed period must have elapsed.

Security Detail Reports

Violation Level Status

The managed devices must exist.

The security policy settings for each report must be enabled.

Windows Update Status

Antivirus Software Status

Mandatory Software Status

Unauthorized Software Status

Security Settings Status

Other Access Restrictions Top N

User Activity Top N

Inventory Detail Reports

Device Management Status

The managed devices must exist.

Green IT (Power Saving Settings)

Asset Detail Reports

Hardware Assets

The hardware asset information must be registered.

All Assets Cost

One of the Hardware Assets, Software Licenses, or Other must be specified in the Contract Target.

Hardware Assets Cost

The Hardware Assets must be specified in the Contract Target.

Software License Cost

The Software Licenses must be specified in the Contract Target.

Other Cost

The Other must be specified in the Contract Target.

Software (License Violation)

The management software information and software license information must be registered.

Software (Surplus License)

4.4 Examining the system configuration

Consider the configuration of the system to be set up. You must select a configuration appropriate for the purpose of the system. The following table describes the types of system configurations that can be set up by using JP1/IT Desktop Management 2.

For system configuration with the asset management server (Asset Console), see the description on the system configuration in the JP1/IT Desktop Management 2 - Asset Console Configuration and Administration Guide.

System configuration type

Features

Minimum configuration

This configuration consists of the management server and managed devices only.

Basic configuration

This configuration includes a relay system to disperse the load on the management server and network when utilizing Remote Install Manager for distribution.

Offline management configuration

This configuration contains managed computers that cannot be connected to the network of the management server. This configuration allows you to manage device information for standalone computers and computers that are connected only to the network in a site.

Agentless configuration

This configuration contains agentless computers to be managed.

Support service linkage configuration

This configuration provides a linkage with support service sites. You can download support information files from the support service site to the management server, and apply the latest information on Windows updates and anti-virus products to security policy. You can also apply the latest Windows updates to the managed computers.

Active Directory linkage configuration

This system configuration is used to collect device information managed by Active Directory. The information collected from Active Directory can be registered on the management server.

MDM linkage configuration

This configuration provides a linkage with an MDM system so that JP1/IT Desktop Management 2 can perform integrated management of devices, including the smart devices managed by the MDM system.

Network monitoring configuration

This configuration provides network monitoring to control network connections of devices. Network connection control of devices is possible if the network monitor agent is installed for the managed computers.

JP1/NETM/NM - Manager linkage configuration

By linking with JP1/NETM/NM - Manager, JP1/IT Desktop Management 2 can control network connections monitored on network control appliance products with JP1/NETM/NM installed.

Remote control configuration

This configuration provides remote control of computers by using the remote control function. File transfer and chatting between computers are also possible.

JP1/IM linkage configuration

This configuration provides a linkage with JP1/IM to allow JP1/IM to perform integrated management of error events generated by JP1/IT Desktop Management 2. Integrated management of information for other linked JP1 products is also possible, allowing you to timely check the information.

Cluster configuration

This system configuration contains a cluster of management servers. If an error occurs on the primary management server, the primary management server is switched to the standby management server on which processing can continue.

Internet gateway configuration

This configuration allows you to manage computers used outside the company via the Internet gateway.

4.4.1 Minimum configuration

The following describes the minimum configuration of a system that is set up for JP1/IT Desktop Management 2. The minimum configuration consists of one management server and the managed devices. The following figure shows the minimum configuration:

The management server diagnoses the security status of the computers according to the specified security policy. Use the operation window to set the security policy and check the security diagnostic results. Use the Web browser to display and use the operation window. In an environment that allows access to the management server from the Web browser, you can log in and use the operation window.

The following describes the prerequisites for the minimum configuration:

The computers to be managed must be connected to one management server.

In an environment that allows TCP/IP communication, a computer can be added as a management target irrespective of whether a LAN or WAN is used.

Because the operation window is used in a Web browser, you can use the operation window on any computer that is available for HTTP communication with the management server.

4.4.2 Basic configuration

A configuration set up for distribution by using Remote Install Manager with a relay system installed is called a basic configuration. Installing a relay system can reduce loads on the network and the management server.

The following is a guideline for installing a relay system:

A relay system is provided for each dispersed site.

A relay system is provided for 1,000 managed computers.

To configure a relay system, create a dedicated agent configuration and assign the configuration to the relay system. For settings of the agent configuration dedicated to the relay system, see items in (4) Agent parameters.

Tip

You can distribute files by using Remote Install Manager without installing a relay system. However, we recommend using one or more relay systems to prevent placing excessive load on the network.

When a relay system is not used, it is generally recommended that no more than 200 managed computers are connected, although this may vary depending on the hardware environment.

The following figure shows the basic configuration.

Distribution to the managed computers in a dispersed site is executed when polling from the relay system occurs.

Settings required in a NAT environment

In the agent configurations for a relay system and agent to be installed on a computer in a dispersed site, specify the management computer to be connected by the global IP address or the host name. If you use the host name, the IP address resolved by using the DNS server or a hosts file must be a global IP address.

Important

Network devices located in a dispersed site and agentless devices cannot be managed in a NAT environment.

4.4.3 Multi-server configuration

A multi-server configuration refers to a hierarchical system that consists of a primary management server and multiple management relay servers. In this configuration, you can perform load distribution among administrators or management servers, or support a NAT environment operation. In a multi-server configuration, you can have a maximum of seven levels of hierarchy, with the primary management server being the first level.

Design the system in a multi-server configuration if you want to use JP1/IT Desktop Management 2 in the following environments:

To operate JP1/IT Desktop Management 2 separately for each department or network configuration

To reduce loads on the network induced by job execution or package distribution when Remote Install Manager is used for data distribution

As in the basic configuration, you can have relay systems in a multi-server configuration. A relay system is considered to belong to one level lower than the management server to be connected by the relay system. If you place a relay system, you will not be able to place any management relay servers on levels that are lower than the level to which the relay system belongs. Note that you cannot place a relay system for a management relay server on the seventh level. For an overview of system configuration with a relay system, see 4.4.2 Basic configuration.

The following figure shows a multi-server configuration.

A maximum of 100 management relay servers can be connected to a management server.

A management relay server can manage a maximum of 30,000 computers.

Restriction on the host names of a management relay servers

The sum of lengths of host names from the hosts directly under the primary management server to the hosts at the lowest level must be no more than 255 bytes, including the separators between the host names. Specify host names for relay systems and management relay servers accordingly.

4.4.4 Offline management configuration

You can manage computers that cannot be connected to the network of the management server, such as standalone computers and computers in a site. A configuration that contains offline managed computers is called the offline management configuration. The following figure shows the offline management configuration.

Although the system configuration in this figure consists of only computers on which agents are installed, the configuration can also contain agentless computers.

The offline management configuration requires that the online management agent is installed on the administrator's computer. The reason is that, to add offline managed computers as the management targets, device information for the target computers must be collected by using external media and then be reported to the management server from the online management agent.

Important

There are functional differences between an offline managed computer and an online managed computer. For details, see (1) Functional differences between agent/agentless management.

4.4.5 Agentless configuration

You can manage computers without agents installed, in addition to computers on which agents are installed. A configuration that contains agentless computers is called the agentless configuration. The following figure shows the agentless configuration.

Although the system configuration in this figure consists of only agentless computers, the configuration can also contain both agentless computers and computers with agents installed.

The following describes the prerequisites for the agentless configuration.

The computers that the management server can directly reference by using the search function are applicable to the agentless configuration. The search function searches for the management target devices connected to the network.

Either of the following types of authentication must be possible.

Set the administrative share for the OS on the managed computers so that JP1/IT Desktop Management 2 can authenticate the logon account for the OS.

Managed computers can be authenticated by SNMP.

For prerequisites for managing agentless computers, see 4.2.8 Prerequisites for agentless management.

Important

There are functional differences between an agentless computer and a computer on which the agent is installed. For details about the functional differences, see (1) Functional differences between agent/agentless management.

4.4.6 Support service linkage configuration

You can download the latest support information files from the support service site and apply the latest information on Windows updates and anti-virus products to the security policy judgment items registered on the management server. You can also automatically download the Windows updates from the Microsoft Web site and apply them to the managed computers. This configuration is called the support service linkage configuration.

Application of anti-virus product information is supported only in Japan.

Tip

A support services contract must be made before you can use the support service linkage configuration.

The following figure shows the support service linkage configuration.

You can use Windows update files to distribute the Windows updates to computers. In an environment that allows Internet connection with the Microsoft Web site, Windows updates are automatically downloaded and a package is created.

The management server automatically updates the Windows update information on a regular basis, that is, once a day (every 24 hours).

In the support service linkage configuration, the management server connects to the support service site and the Microsoft Web site via the Internet. Therefore, confirm that the management server is able to connect to the Internet. In a multi-server configuration, note that a support service linkage configuration must be built for each management server that uses the support service site. For details about other system features and prerequisites, see 4.4.1 Minimum configuration.

Tip

Even in an environment in which the management server has no Internet connection, you can manage information on Windows updates and anti-virus products. In this case, an Internet-connectable computer other than the management server acquires the support information file from the support service site, and then uploads it to the management server. This computer also downloads the executable file for the Windows updates to be distributed from the Microsoft Web site, and then uploads the executable file to management server.

4.4.7 Active Directory linkage configuration

JP1/IT Desktop Management 2 can link with Active Directory so that the information managed by Active Directory can be collected as device information. To link with Active Directory, one of the following OSs is required on the Active Directory server.

Windows Server 2019

Windows Server 2016

Windows Server 2012

Windows Server 2008

Windows Server 2003

The following figure shows the Active Directory linkage configuration.

After you have set up the environment for the Active Directory linkage configuration, use the Active Directory view of the Settings module to set the linkage with Active Directory. If necessary, specify the information that is to be acquired as additional device information.

Tip

Multiple Active Directory domains can also be linked so that JP1/IT Desktop Management 2 can perform integrated management of the information managed by multiple domains. There is no restriction on the number of Active Directory domains that can be linked.

4.4.8 MDM linkage configuration

JP1/IT Desktop Management 2 linked with an MDM system provides integrated management of devices and assets, including the smart devices managed by the MDM system.

Tip

When using Microsoft Intune as an MDM system, you can manage PCs whose operating system is Windows in addition to smart device.

The following MDM systems can be linked.

Product

Version

JP1/IT Desktop Management 2 - Smart Device Manager

11-00, 12-00

MobileIron

5.8, 5.9, 7.5, and 10#

Microsoft Intune

--

Google Workspace

--

Legend: --: None

Tip

If you use Google Workspace as MDM System, you can manage ChromeOS and ChromeOS Flex devices only.

#: Include revisions.

The following figure shows the system configuration that links an MDM system to manage smart devices.

After you have set up the MDM linkage configuration, use the MDM Linkage Settings view of the Settings module to set the MDM linkage. When the setting is completed, information about smart devices is acquired from the MDM system according to a schedule. The smart devices whose information has been acquired are handled as discovered devices, which can be added as the management targets of JP1/IT Desktop Management 2.

If smart device information is updated in the MDM system, the information in JP1/IT Desktop Management 2 is also updated when the smart device information is acquired. Therefore, when linking the MDM system, we recommend that you set the schedule to acquire information on a regular basis.

4.4.9 Network monitoring configuration

You can monitor the network to control network connection for devices. You can also automatically block the network connections of computers which are determined to have insufficient security measures. The following figure shows a system configuration in which network monitoring is used.

To monitor the network, you must install an online managed computer with the network monitor enabled (computer that monitors the network) for each network segment.

Do not clear the following check boxes in the Basic settings in the agent configurations assigned to the computer that monitors the network.:

Communicate with the higher system

Periodically notify the higher system of the information collected from the computer

In the Network List view of the Inventory module, select one computer for each network segment group (for each broadcast domain), and then enable the network monitor.

Important

When you use the network monitor, NX NetMonitor and JP1/NETM/NM cannot be used with JP1/IT Desktop Management 2. Before using the network monitor, you must first uninstall any instances of NX NetMonitor and JP1/NETM/NM from the computers within the network segment.

Tip

When you enable the network monitor for a computer, the network monitor agent is installed on that computer.

You can also install JP1/IT Desktop Management 2 - Network Monitor on the online managed computer from the distribution media, and then enable the network monitor.

If the network monitor is enabled, a computer that is newly connected to the network is automatically discovered, and network connections within the network segment are controlled according to the network monitor settings. Note that the network monitor can be enabled on only one computer in a network segment.

Tip

Ensure that the computer with the network monitor enabled is running 24 hours a day. While the computer is turned off, the network monitor cannot control network connection nor discover devices.

Tip

You can join multiple VLANs (Virtual LANs) by using the VLAN trunk connection function to monitor multiple subnetworks (VLANs) on a single computer (and a single network card), provided that the following prerequisites are satisfied.

The network card of the computer that monitors the network supports EEE 802.1Q (VLAN).

Tagged VLAN and trunk connection (passing multiple VLANs) can be set on the port of the switch to which the computer that monitors the network is connected.

4.4.10 Remote control configuration

An administrator can connect to and operate remote computers.

The following figure shows a remote control configuration.

An administrator's computer that connects to remote computers requires a controller. When you click the Remove Control button in the Inventory module, the controller is automatically installed on the administrator's computer.

Important

You cannot install the controller on a computer running the UNIX or Mac operating system. An agent for UNIX or Mac does not include the remote control agent, which is a program required on a remotely-controlled computer.Note that the remote control function can be used on a computer running Linux or Mac OS if the computer is connected by using RFB.

4.4.11  JP1/IM linkage configuration

This system configuration allows you to link with JP1/IM. This allows JP1/IM to manage, as JP1 events, error events generated in managed computers and severe events that require the intervention of the administrator. The following figures show JP1/IM linkage configurations.

The JP1/IM linkage configuration requires JP1/IM and JP1/Base.

During setup of the JP1/IM linkage configuration, you must define the configuration file and the definition file for the extended event attributes.

To check a generated event and take measures against it, you must use the management server that generated the event. Therefore, in a multi-server configuration, a JP1/IM server must be provided for each management relay server that manages each site. The following figure shows a JP1/IM linkage configuration in a multi-server configuration.

Tip

You can also manage all the sites using a single JP1/IM server. To do so, configure the management servers to link with the same JP1/IM server.

4.4.12 Cluster configuration

The management server can be configured in a cluster configuration, which consists of a running server (called the primary server) and a standby server. If an error occurs in the primary server, processing is passed to the standby server via a shared disk. The cluster configuration of a server allows processing to continue even if an error occurs in the primary server. The following figure shows a cluster configuration:

The following describes the prerequisites for a cluster configuration.

The usable cluster software programs are Windows Failover Cluster Server.

On the managed computers, specify the logical network name and logical IP address in the connection-destination management server settings. By doing so, the computers do not need to identify the management server they are connected to.

Important

Management relay servers in a multi-server configuration, network monitor, and internet gateway cannot be configured in a cluster configuration.

4.4.13 JP1/NETM/NM - Manager linkage configuration

By linking with JP1/NETM/NM - Manager, JP1/IT Desktop Management 2 can control network connections monitored on network control appliances.

Important

You cannot place a network control appliance in a network segment with the network monitor enabled.

The following figure shows a JP1/NETM/NM - Manager linkage configuration.

In a multi-server configuration, perform either of the following to link with JP1/NETM/NM - Manager:

Install JP1/NETM/NM - Manager on management servers that monitor network connections through network control appliances.

Install JP1/NETM/NM - Manager only on the primary management server.

In this case, you must configure the primary management server to enable automatic update of the network control list for the devices that are managed by management relay servers under the primary management server.

Note that JP1/NETM/NM - Manager cannot manage JP1/NETM/NM via a NAT device. If you want to use JP1/NETM/NM - Manager to manage network connections in a NAT environment, you must install JP1/NETM/NM - Manager on a management relay server placed in the NAT environment.

Related Topics:

2.8.8 Managing the network control list

4.4.14 Internet gateway configuration

JP1/IT Desktop Management 2 allows you to keep track of the managed computers taken out of the company via the Internet gateway server. This is enabled by the so-called Internet gateway configuration. The following figure shows the Internet gateway configuration:

The managed computers taken out of the company are connected to the management server via the Internet gateway. Managed computers are connected to the Internet gateway via HTTPS.

You can also connect a management relay server located outside the company to higher management server via an Internet gateway.

Up to 5,000 devices can be managed with one Internet gateway. Also, you can install multiple internet gateways. To ensure stable operation of internet gateway and relay system, please do not install other server products.

The following describes the prerequisites for the Internet gateway configuration:

Either an agent or a relay system must be installed on the Internet gateway server.

The Internet gateway server must be placed in the demilitarized zone (DMZ) of the corporate network.

An agent must be installed on each managed computer.

The following settings must be configured on a management relay server when connecting higher management server through an Internet gateway:

Creating an Internet connection settings file that specifies the Internet gateway server information to connect to

• Executing rlyigwsetconf command

A firewall placed at the boundary between the Internet and the DMZ and the one placed at the boundary between the DMZ and the internal network must allow the communication described below.

A firewall placed at the boundary between the Internet and the DMZ:

Inbound communication that allows the managed computers connected to the Internet to connect to the Internet gateway server in the DMZ

A firewall placed at the boundary between the DMZ and the internal network:

Inbound communication that allows the Internet gateway server in the DMZ to connect to the management server in the internal network

4.4.15 NAT Environment Configuration

If you are using JP1/IT Desktop Management 2 in a NAT environment, consider installing a management relay server or a relay system in the internal network. If there are many devices to be managed, you can reduce the network load related to the amount of external network traffic and the number of connections.

(1) Internal network with Management Relay Server installed configuration

This section describes internal network with Management Relay Server installed configuration.

By setting the NAT device (hereafter, NAT device A) of the same network as the management server (hereafter, management network), statically allocate the internal IP address of the management server to the IP address of the external network.

If you need to perform operation (such as message notification, update device details, etc.) on the managed device under the management relay servers, perform the operation from the management screen of the management relay server.

You cannot connect to the management relay server from the Remote Install Manager of the management network.

Settings for Internal network with Management Relay Server installed

The Management Relay Server Setup

Set the following setting values for the management relay servers. For details on setting up the management relay server, see the procedure for setting up the management relay server in the JP1 / IT Desktop Management 2 Configuration Guide.

Setting item

Setting value

Higher connection destination

External IP address of the management server, or Host name resolved to the external IP address of the management server

Agent Configuration of Management relay server

Set the agent configuration assigned to the managed device on the management relay server management screen to the following setting value. For details about the agent configuration, see the description of managing agent configurations in the JP1/IT Desktop Management 2 Administration Guide.

Setting item

Setting value

Management server

IP address of the management relay server, or Host name resolved to the IP address of the management relay server

Higher System for Distribution that Uses Remote Install Manager

IP address of the management relay server, or Host name resolved to the IP address of the management relay server

Example of settings for Internal network with Management Relay Server installed

IP address settings

Setting item

Setting value

Management server IP address (External Network)

10.10.10.10

Management server IP address (Internal Network)

192.168.10.10

Management relay server IP address (Internal Network)

192.168.20.10

Management Relay Server Setup

Setting item

Setting value

Higher connection destination

10.10.10.10

Management Relay Server Agent Configuration

Setting item

Setting value

Management server

192.168.20.10

Higher System for Distribution that Uses Remote Install Manager

192.168.20.10

(2) Internal network with Relay System installed configuration

This section describes internal network with Relay System installed configuration.

By setting the NAT device (hereafter, NAT device A) of the same network as the management server (hereafter, management network), statically allocate the internal IP address of the management server to the IP address of the external network.

Operation (such as message notification, update device details, etc.) or network control to the managed device on a different network with the management network is performed on polling timing.

Agentless management of managed device on different network with management network can not be performed.

For notification of inventory information etc., direct communication occurs between the managed device and the management server. To reduce the communication load, consider installing a management relay server.

Settings for internal network with Relay System installed

Agent Configuration of Management relay server

Set the agent configuration assigned to the managed device on the management relay server management screen to the following setting value. For details about the agent configuration, see the description of managing agent configurations in the JP1/IT Desktop Management 2 Administration Guide.

Setting item

Setting value

Management server

External IP address of the management server, or Host name resolved to the External IP address of the management server

Higher System for Distribution that Uses Remote Install Manager

IP address or Host name of Relay System

Relay System Setup

Set the following setting values for the Relay System. For details on setting up the Relay System, see the procedure for setting up the Relay System in the JP1 / IT Desktop Management 2 Configuration Guide.

Setting item

Setting value

Communicate with the higher system

Check

Host Name or IP Address:

External IP address of the management server, or Host name resolved to the External IP address of the management server

Example of settings for Internal network with Relay System installed

IP address setting

Setting item

Setting value

Management server IP address (External Network)

10.10.10.10

Management server IP address (Internal Network)

192.168.10.10

Relay IP address (Internal Network)

192.168.20.10

Agent configuration of Management Server

Setting item

Setting value

Management Server

10.10.10.10

Higher System for Distribution that Uses Remote Install Manager

192.168.20.10

Relay System Setup

Setting item

Setting value

Communicate with the higher system

Check

Host Name or IP Address:

10.10.10.10

(3) Internal network without Management Relay Server or Relay System installed configuration

This section describes internal network without Management Relay Server or Relay System installed configuration.

By setting the NAT device (hereafter, NAT device A) of the same network as the management server (hereafter, management network), statically allocate the internal IP address of the management server to the IP address of the external network.

Operation (such as message notification, update device details, etc.), network control, or distribution to the managed device on a different network with the management network is performed on polling timing.

Agentless management of managed device on different network with management network can not be performed.

Direct communication occurs between the managed device and the management server. To reduce the communication load, consider installing a management relay server or relay system.

Settings for Internal network without Management Relay Server or Relay System installed

Agent configuration of Management Server

Set the agent configuration assigned to the managed device on the management server management screen to the following setting value. For details about the agent configuration, see the description of managing agent configurations in the JP1/IT Desktop Management 2 Administration Guide.

Setting item

Setting value

Management server

External IP address of the management server, or Host name resolved to the External IP address of the management server

Higher System for Distribution that Uses Remote Install Manager

External IP address of the management server, or Host name resolved to the External IP address of the management server

Example of settings for Internal network without Management Relay Server or Relay System installed

IP address setting

Setting item

Setting value

Management server IP address (External Network)

10.10.10.10

Management server IP address (Internal Network)

192.168.10.10

Agent configuration of Management Server

Setting item

Setting value

Management Server

10.10.10.10

Higher System for Distribution that Uses Remote Install Manager

10.10.10.10

(4) NAT Environment Precautions

When operating remote control in NAT environment, the precautions are as follows:

If you cannot connect from the controller's device to the computer to be controlled, but the controller's device can be connected from the computer to be controlled, execute the connection request to the controller from the computer to be controlled.

When operating remote control in NAT environment, the precautions are as follows:

In environments with multiple networks, there may be multiple devices with the same IP address on each network. In such environment, if the network connection check format is set to IP address, it might cause unintentional interruption to the connection of the device used for the business operation, leading to trouble. It is recommended that you set the network connection check format to MAC address or MAC address + IP address.

4.4.16 External system linkage configuration

You can also manage device information by using JP1/IT Desktop Management 2 through linkage with an external system. This is called the external system linkage configuration. There are two patterns to the external system linkage configuration: the one in which both the external system and the management server exist within the internal network and the one in which the external system exists on the Internet.

The following figure shows what the external system linkage configuration looks like:

By using the API provided by JP1/IT Desktop Management 2, the external system communicates with the management server via HTTP connection or HTTPS connection.

If the external system exists on the Internet, a reverse proxy server is placed in the DMZ so that the external system can communicate with the management server via the reverse proxy server.

Note

When an external system existing on the Internet is using the API to connect to the management server via HTTPS connection, SSL server certificates should be placed as follows:

Between the external system and the reverse proxy server: Place an SSL server certificate on the reverse proxy server.

Between the reverse proxy server and the management server: Place an SSL server certificate on the management server.

For details about how to build an environment in which an external system uses the API to connect to the management server via HTTPS connection, see Building an environment for using HTTPS with the external system linkage configuration in the JP1/IT Desktop Management 2 Configuration Guide.

4.5 Examining the database

JP1/IT Desktop Management 2 uses a database to manage information necessary for management, including the information collected from managed devices and information calculated for reports.

The database is created during setup of an environment. Estimate the required database size in advance according to the system configuration and operation method, and provide the appropriate environment.

Tip

After starting operation, you can use the database manager to back up and restore the management server database and to perform maintenance for efficient use of the database.

Related Topics:

4.5.1 Database overview

4.5.2 Disk space requirements for the management server

4.5.8 Guidelines for recommended disk space

4.5.4 Guidelines for disk space requirements for the operation log database

4.5.3 Guidelines for disk space requirements for operation log backup folder

4.5.1 Database overview

JP1/IT Desktop Management 2 has multiple database folders and data storage folders according to the type.

The destination of each folder can be specified when you set up the management server.

The following table lists and describes the folders.

Folder type

Description

Created?

Database folder

A folder in which a database area is created for storing management information, including device information, asset information, security policies, events, and reports

Yes

Data folder

A folder that stores data, such as the registered agents and packages created by the distribution function

Yes

Local data folder

A folder used as a management server temporary folder during operation

Yes

Operation log backup folder

A folder for saving backed-up operation log data. When you restore operation logs in the operation window, the data in this folder is stored in the operation log database folder, which allows you to reference past operation logs.

C

Operation log database folder

A database area that stores operation log data, from which you can view operation logs collected from computers. Automatically restored operation logs and manually restored logs are stored.

C

Revision history output folder

A folder to which revision histories are output periodically for archival purposes.

C

Database extraction folder

A folder for temporarily saving data when the database folder is changed. This folder is not used during normal operation

Yes

Legend: Yes: Always created, C: Created depending on the setting

Tip

Only the disk that the OS of the management server recognizes as a local drive can be specified for the folders. Note, however, that for the operation log backup folder, a network folder can be specified. Therefore, we recommend that you use large-capacity storage for the operation log backup folder and use a hard disk on the management server for other folders. Also note that you cannot specify a storage device that is identified as a removable disk.

4.5.2 Disk space requirements for the management server

The following describes the disk space requirements for data folders on the management server.

In addition to the disk space shown in the table below, we recommend that you allocate 1 GB of free space to a local data folder for use as a work folder during operation. To acquire operation logs, you need to add 500 MB of disk space for 5,000 managed computers. AlthoughJP1/IT Desktop Management 2 uses information not covered in the following table, such information requires a relatively small space and therefore has little influence on the estimate.

Data folder

Saved data

Storage period

Disk space

Database folder

The following information used by the management server:

Security policy

Group

Agent configurations

Stored until deleted.

0.5 GB

The following asset information:

Hardware asset information

Managed-software information

Software license information

Contract information

Stored until deleted.

0.1 GB

In addition, this value is based on the assumption that the following information items are registered, and that for each information item, no additional management items exist:

Hardware asset information: 20,000 items

Managed-software information: 500 items

Software license information: 100 items

Contract information: 100 items

Device information for managed devices

Stored until deleted.

10 GB

This is based on the assumption that 10,000 devices are managed.

Revision history

Stored until the used disk space reaches the maximum. If the maximum space is exceeded, entries are deleted beginning from the oldest.

Approximately 7 GB

This is based on the assumption of a system with 10,000 managed devices, in which the number of device information changes recorded daily per device is the total of the following:

Number of changes recorded in day-to-day operation: 14

Number of invalid changes: 0.1 (one invalid change per device in 10 percent of devices)

Events

Stored until the used disk space reaches the maximum. If the maximum space is exceeded, events are deleted, beginning from the oldest.

(250 x Number of managed computers 10,000 + 10,000) x 1.5 KB = Approximately 4 GB

This is based on the assumption that the following conditions exist:

250 events are generated for one managed device per day

The number of managed computers is 10,000.

10,000 events are generated per day irrespective of the number of managed devices.

One event requires 1.5 KB of disk space.

Reports for the specified storage period

Stored for the specified number of years (from 1 to 10) as the storage period.

10 GB

This is based on the assumption that reports are stored for 10 years.

Data folder

Attachments for the following asset information:

Hardware asset information

Software license information

Contract information

Stored until deleted.

5 GB

In practice, the required disk space might exceed 5 GB, because the required disk space increases with the number of registered information items.

This value is also based on the assumption that the information items below are registered, and that no information items exist to which many large files are registered. To register and manage many large files, allocate sufficient free space separately.

Hardware asset information: 20,000 items

Software license information: 100 items

Contract information: 100 items

Packages used by the distribution function

Stored until deleted.

Approximately 10 GB

This is based on the assumption that 1,000 10 MB packages are registered. Note that the packages distributed from the higher management server are also included.

Temporary storage data of operation logs

Stored until the data is stored in the operation log backup folder.

Approximately 150 GB

Required for acquiring operation logs. This is based on the assumption that the following conditions exist, and when operation log backup to the backup folder has not been performed for 2 weeks (5 business days per week):

Number of managed computers: 10,000

All the operation logs are acquired.

Periodic export of the operation logs are not performed.

Information to be sent to the higher management server

Information is stored until it is sent to the higher management server.

24 GB

Required for the management relay server. This value is based on the assumption that information has not been sent to the higher management server for 2 weeks (5 business days per week).

Operation log database folder

Operation logs when only operations closely related to information leakage are logged (automatically restored operation logs)

Operation logs are stored for a period specified in the Period for storing automatically restored operation logs field under Operation Log Settings in the Settings module.

Approximately 45 GB

This is based on the assumption that the following conditions exist:

Number of managed computers: 10,000

The amount of operation logs per computer per day is 93 KB.

1 month (30 days) of operation logs are acquired.

Operation logs when all operations are logged (automatically restored operation logs)

Operation logs are stored for a period specified in the Period for storing automatically restored operation logs field under Operation Log Settings in the Settings module.

Approximately 446 GB

This is based on the assumption that the following conditions exist:

Number of managed computers: 10,000

The amount of operation logs per computer per day is 1.52 MB.

All the operation logs are acquired.

1 month (30 days) of operation logs are acquired.

Operation logs restored from the backup folder for reference in the operation log list (manually restored operation logs)

Stored until deleted.

Approximately 135 GB

This is based on the assumption that the following conditions exist:

The amount of operation logs per computer per day is 1.52 MB.

All the operation logs are acquired.

3 months (3 x 30 days) of operation logs for 200 computers are acquired.

Operation log backup folder

Backed up operation logs

These logs are stored until deleted when the operation log backup folder is specified.

If you attempt to reference the restored operation logs in the operation log list, they are restored in the operation log database folder, but the operation logs in the operation log backup folder are not deleted.

There is no space limitation.

Prepare a backup folder by referring to the value obtained as follows: Storage period (days) defined by the administrator x number of managed computers x 70 (KB per day per device).

This is based on the assumption that the following conditions exist:

All the operation logs are acquired.

Periodic export of the operation logs is not performed.

Revision history output folder

Archived revision history

When you enable output of the revision history archive, revision histories are output to this folder as CSV files at regular intervals.

Approximately 10 GB

This is based on the assumption that 10,000 devices are managed, and the revision history archive spans five years.

Related Topics:

A.6 Performance and Estimates

4.5.3 Guidelines for disk space requirements for operation log backup folder

The following table shows the guidelines for disk space requirements for storing operation logs for one year in the backup folder.

Number of managed computers#1

Required disk space (GB)

Operation log data#2

CSV file output by the periodic export operation

500

8 (5)

75 (90#3)

1,000

16 (10)

151 (179#3)

2,000

32 (20)

302 (358#3)

5,000

80 (48)

754 (896#3)

10,000

160 (96)

1,509 (1,792#3)

30,000

480 (288)

4,526 (5,377#3)

Note: One year is calculated as 240 days (20 business days per month).

#1: If you are collecting operation logs for the Citrix XenApp and Microsoft RDS server, assume that one computer equals the portion of virtual environment dedicated to one Citrix XenApp and Microsoft RDS user.

#2: The number enclosed in parentheses represents an approximate size when 2,000 HIBUN logs are imported per day. When acquiring HIBUN logs, add the number enclosed in parentheses. It depends on the types of HIBUN logs to be imported and your environment. Therefore, operate the logs for about one week or one month before determining the required disk space.

#3: The disk space required when the operation date and time of the source agent (local time, UTC time, and time zone) are output. Set the OpLog_ExportSourceDateAndTime property in the configuration file (jdn_manager_config.conf) to ON. For details about the OpLog_ExportSourceDateAndTime property, see A.5 Lists of properties.

The following formulas are used to calculate the disk capacity required for backing up operation logs.

Operation log data:

Number of devices x 69.9(KB) / 1024 / 1024 x Number of days

CSV files output by periodic export:

Number of devices x 659.2(KB) / 1024 / 1024 x Number of days

CSV files output by periodic export#:

Number of devices x 783.1(KB) / 1024 / 1024 x Number of days

#3: The disk space required when the operation date and time of the source agent (local time, UTC time, and time zone) are output. Set the OpLog_ExportSourceDateAndTime property in the configuration file (jdn_manager_config.conf) to ON. For details about the OpLog_ExportSourceDateAndTime property, see A.5 Lists of properties.

Related Topics:

A.6 Performance and Estimates

4.5.4 Guidelines for disk space requirements for the operation log database

Use the following formula as a guideline for estimating the disk space required for automatically restoring operation logs to the database.

When all the operation logs are acquired

Number of managed computers x Period for storing automatically restored operation logs (days)# x 1.52 (MB) = Disk space required for automatic restoration (in MB)

#: The period for storing automatically restored operation logs is 300 days at maximum.

However, if the disk space required for automatic restoration is less than Period for storing automatically restored operation logs (days) x 1.5 (GB), the guideline for the disk space should be Period for storing automatically restored operation logs (days) x 1.5 (GB).

When HIBUN logs are imported, the disk space required depends on the types of HIBUN logs to be imported and your environment. Therefore, operate the logs for about one week or one month, use the following formula to determine the daily disk usage, and then multiply the usage by the safety factor (about 1.5) to obtain the disk space.

Period for storing automatically restored operation logs (days) x Disk usage per day (MB) x Safety factor = Disk space required for automatic restoration (in MB)

The following shows a guideline for the disk space required when the number of automatically restored operation logs is 100,000,000 and 300,000,000.

With 100,000,000 operation logs

74.3 GB

With 300,000,000 operation logs

222.7 GB

When the number of automatically restored operation logs is 100,000,000 and 300,000,000, the operation logs can be stored in the database for the following period.

Number of managed computers

Guideline for the number of days during which the operation logs can be stored

100,000,000 operation logs (118.9 GB of disk space)

300,000,000 operation logs (356.3 GB of disk space)

500

4 months

1 year

1,000

2 months

6 months

2,000

1 month

3 months

5,000

2 weeks

1 month

10,000

1 week

3 weeks

30,000

1.5 days

1 week

Note: A month is calculated as 20 business days.

Use the following formula for estimating the disk space required when you manually restore the operation logs to the database.

When all the operation logs are acquired

Number of computers whose operation logs are to be restored x Period for operation logs to be restored per day (days) x 1.52 (MB)

If the calculated value is less than Period for operation logs to be restored per day (days) x 1.5 (GB), the guideline for the disk space should be Period for operation logs to be restored per day (days) x 1.5 (GB).

When HIBUN logs are imported manually, the guideline for the disk space should be Disk usage per day (MB) x Period for operation logs to be restored per day (days), which is determined when you obtain disk space required for automatic restoration.

When you manually restore the operation logs for 3 months for 200 managed computers

The following formula is estimating the disk space required when you manually restore the operation logs.

90 days x 1.5 (GB) = 135 (GB)

When manually collecting the operation log of half a year (180 days) from 200 computers on one day time span, the approximate disk capacity of the operation log that is manually collected is as follows.

180 days x 1.5 (gigabyte) = 270 (gigabyte)

Assuming that the number of days for automatic collection is 30 days, set the maximum number of days of setup operation log setting to 210 days.

Important

Even if the operation log is deleted from the management screen, the size of the operation log database will not be reduced. When collecting and deleting operation logs, do not subtract the amount of deletion, but only consider the amount of data to be collected as the approximate disk capacity. For details about the operation log database, refer to 2.10.2 Managing operation logs on the management server.

Related Topics:

A.6 Performance and Estimates

4.5.5 Guidelines for disk space requirements in the data folder for acquiring operation logs

To acquire operation logs, you need to add the following disk space to the data folder.

Number of managed computers

Required disk space (GB)

When the periodic export is disabled

When the periodic export is enabled

5,000

75

105 (112#)

10,000

150

209 (224#)

30,000

448

627 (672#)

Note: The table above calculates the disk space required to store 2 weeks (5 business days per week) of operation logs. If an error occurs in the operation log storage folder or operation log database, the operation log data is accumulated in the data folder. It is assumed that the failure will recover in 2 weeks (5 business days per week).

#: The disk space required when the operation date and time of the source agent (local time, UTC time, and time zone) are output. Set the OpLog_ExportSourceDateAndTime property in the configuration file (jdn_manager_config.conf) to ON. For details about the OpLog_ExportSourceDateAndTime property, see A.5 Lists of properties.

The following formulas are used to calculate the disk capacity of a data folder required for collecting operation logs.

Periodic export is disabled:

Number of devices x 15.3(MB) / 1024

CSV files output by periodic export:

Number of devices x 21.4(MB) / 1024

CSV files output by periodic export#:

Number of devices x 22.9(MB) / 1024

#: The disk space required when the operation date and time of the source agent (local time, UTC time, and time zone) are output. Set the OpLog_ExportSourceDateAndTime property in the configuration file (jdn_manager_config.conf) to ON. For details about the OpLog_ExportSourceDateAndTime property, see A.5 Lists of properties.

Related Topics:

A.6 Performance and Estimates

4.5.6 Guidelines for disk space requirements for revision history archive

The table below lists the guidelines for estimating the disk space requirements when outputting a revision history archive.

The values in this table assume the following scenario:

The revision history archive will span five years.

Over the course of five years, approximately 100 changes will be recorded for each managed device.

Number of devices

Required disk space (GB)

500

0.5

1,000

1

2,000

2

5,000

5

10,000

10

30,000

30

50,000

49

100,000

98

300,000

293

The following formulas are used to calculate the disk capacity required for outputting the change history.

Number of devices x 17.07(KB) / 1024 / 1024 x Number of Months

4.5.7 Guidelines for disk space requirements for revision history database

The table below lists the guidelines for estimating the disk space requirements of the revision history database.

The values in this table assume that the number of device information changes recorded daily per device is the total of the following. If the number of changes is likely to exceed this number, make sure that enough disk space is available to meet the requirements.

Number of changes recorded in day-to-day operation: 14

Number of invalid changes: 0.1 (one invalid change per device in 10 percent of devices)

Number of devices

Required disk space (GB)

Less than 2,000

5

5,000

6

10,000

7

30,000

10

50,000

14

100,000

22

300,000

56

The following formulas are used to calculate the disk capacity required for the change history database.

Number of devices x 178(KB) / 1024 / 1024 + 4.6(GB)

4.5.8 Guidelines for recommended disk space

The following describes the guidelines for the recommended disk space for all data (including operation logs) managed by JP1/IT Desktop Management 2. These guidelines vary depending on the types of operation logs to be acquired.

For the management relay server, add disk space for the information to be sent to the higher management server (24 GB), to each recommended disk space value in the guidelines below.

When all operations are logged

Number of managed devices

Recommended disk space (GB)#1

1 year#2

2 years#2

3 years#2

4 years#2

5 years#2

100

240

242

243

245

247

500

259

267

275

283

291

1,000

281

297

313

329

345

2,000

371

403

435

467

499

3,000

464

512

560

608

656

5,000

645

725

805

885

965

10,000

1,218

1,374

1,538

1,698

1,858

30,000

3,164

3,644

4,124

4,604

5,084

100,000

3,417

3,897

4,377

4,857

5,337

300,000

4,137

4,617

5,097

5,577

6,057

#1: The value is based on the assumption that a constant amount of data is generated per day, and the data is accumulated every day according to an assumed environment.

#2: Operation log storage period. For calculation of the amount of data, one year is handled as 240 days (20 business days per month).

When only operations closely related to information leakage are logged

Number of managed devices

Recommended disk space (GB)#1

1 year#2

2 years#2

3 years#2

4 years#2

5 years#2

100

236

236

236

236

236

500

237

237

238

238

239

1,000

238

239

240

241

242

2,000

241

243

245

247

249

3,000

246

249

252

254

257

5,000

251

256

261

266

271

10,000

386

396

405

415

425

30,000

614

643

672

701

730

100,000

867

896

925

954

983

300,000

1,587

1,616

1,645

1,674

1,703

#1: The value is based on the assumption that a constant amount of data is generated per day, and the data is accumulated every day according to an assumed environment.

#2: Operation log storage period. For calculation of the amount of data, one year is handled as 240 days (20 business days per month).

The following table describes the assumed environment used for calculating the recommended disk space.

Item

Assumed environment

Device

100 types of groups, including department and location, are created.

The number of devices excluded from management is 15% of the number of managed devices.

300 software products (installation software) are installed on one managed device.

One managed device has 300 Windows updates applied.

One managed device has 100 Windows updates that have not been applied yet.

Operation log

If only operations closely related to information leakage are logged, 120 operation logs are acquired for one device.

If all operations are logged, 2,000 operation logs are acquired for one device.

30 (days) is specified for Period for storing automatically restored operation logs.

Operation logs for 200 computers for 3 months (20 business days per month) are manually restored. However, if there are 100 managed computers, operation logs for 100 computers are manually restored.

Periodic export of the operation logs is not performed.

In the Capacity to be added to the cache of setup, specify 1 GB for every group of 2,500 managed computers.

Asset

The number of registered items of hardware asset information (excluding USB devices) is twice as many as the number of managed devices.

100 items of hardware asset information (USB device) are registered.

500 items of managed-software information are registered.

100 items of software license information are registered.

100 items of contract information are registered.

We assume that many large files are not registered for each asset information item. To register many large files to be managed, allocate sufficient free space in addition to the disk space shown in the two tables above.

Revision history

Periodic output of the revision histories to be restored is not performed.

Distribution

10 GB of data is registered for packages.

Event

250 events are generated for one managed device per day.

Related Topics:

A.6 Performance and Estimates

4.5.9 Acquiring operation logs when the connection destination of the agent is turned off

If a user performs an operation on a computer with the agent installed while the management server on which operation logs will be stored is turned off, operation logs are temporarily saved on the computer.

After that, when the management server is turned on, the operation logs saved on the computer are uploaded to the management server.

Important

The operation logs for the number of days specified in the Period for which prohibited operations and operation logs are kept on the user's computer field under Common settings for prohibited operations and operation logs in the Security module can be temporarily stored on the computer. If the period expires, the operation logs are deleted, in the order of oldest to newest. Therefore, we recommend that you turn on the connection destination before old operation logs are deleted.

Tip

When the operation logs are acquired periodically, operation logs saved on the computer with the agent installed are also uploaded to the management server .

In addition, do not turn off the management server for a long period.

4.6 Analysis and Preparation before operation

Before starting system operation, examine the issues that must be specified during operation, including to whom a user account should be assigned, which devices should be managed, and how the managed devices should be grouped.

4.6.1 User account considerations

You need to carefully consider JP1/IT Desktop Management 2 user assignments. Specifically, consider for whom you will create user accounts and which permissions you will assign to the created user accounts.

You can assign appropriate permissions to a user account according to the purpose of the administrator who will use the account. The following describe which permissions should be assigned for the purpose of operation.

To perform administrative operations by using JP1/IT Desktop Management 2:

Assign system administrator permission.

To add and edit a user account for JP1/IT Desktop Management 2:

Assign user management permission.

To view the managed information:

No permissions need to be assigned (view permission is assigned by default).

Assign tasks so as to limit the range of operations for JP1/IT Desktop Management 2 according to the tasks for which the administrators are responsible.

There are five types of tasks: security control, asset management, device management, distribution management, and system configuration management.

In addition to permissions, an administration scope can also be assigned to a user account to limit that user to manage information only in that scope. Assign an administration scope if you do not want a user to change information outside the administration scope or if you want to divide management tasks by administration scope. By thus dividing work responsibilities among administrators, you can ensure efficient management of devices and hardware assets in the organization.

Tip

By creating multiple user accounts and assigning permissions according to the tasks of the users, you can ensure a proper division of responsibilities and effective internal controls among the administrators of a system.

Related Topics:

2.3.3 User account permissions

2.3.3 User account permissions

2.3.5 Task allocations for user accounts

2.3.6 Available operations by task allocation

2.3.7 Administration scopes for user accounts

2.3.8 Differences in operation windows when administration scopes are assigned

4.6.2 Creating user accounts for efficient internal controls

4.6.2 Creating user accounts for efficient internal controls

To provide efficient internal controls, you need to register user accounts to restrict the available functions according to the jobs of JP1/IT Desktop Management 2 users. The following table provides an example of a management structure that provides efficient internal controls.

Management structure

Role

System owner

Controls and manages the usage of the system in the organization. The system owner approves applications to use JP1/IT Desktop Management 2, but does not use JP1/IT Desktop Management 2.

User account manager

Manages JP1/IT Desktop Management 2 users. User management permission is assigned.

System administrator

Uses JP1/IT Desktop Management 2 to perform management tasks. System administrator permission is assigned.

Manager

Views managed information to check the management status of the organization. View permission is assigned.

In this structure example, only the user account manager can use JP1/IT Desktop Management 2 from the beginning. The system administrator and manager must apply to the system owner for the use of JP1/IT Desktop Management 2. When the system owner approves an application, the user account manager registers a user account with the necessary permissions assigned.

The following describes the basic procedure for registering a user account. By registering a user account in this way, whether the system is used in accordance with the task of the user can be determined objectively.

A user who wants to use JP1/IT Desktop Management 2 applies to the system owner.

A system administrator who wants to perform management tasks or a manager who wants to view the managed information applies to the system owner for the use of JP1/IT Desktop Management 2.

The system owner approves the use of the product.

The system owner asks the user account manager to create a user account.

The user account manager creates a user account.

System administrator permission is assigned to a system administrator. No permissions are assigned to a manager so that he or she can only view information.

The user account manager reports the result of user account creation to the system owner.

The user account manager informs the user that the account has been created.

The system administrator or manager will be able to use JP1/IT Desktop Management 2 with restricted functions.

Periodical audit is performed to check the registration status of user accounts.

Audit the application trail and the user account registration status to confirm that the system is being used correctly.

4.6.3 Analyzing management targets

JP1/IT Desktop Management 2 allows device management, security control, and asset management. The range of target devices varies depending on the management methods. Before starting operation, you need to determine which devices in the organization you want to manage.

In addition, you can use online management for computers that can be connected to the network, and use offline management for computers that cannot be connected to the network. For details about functional differences between online management and offline management, see (1) Functional differences between agent/agentless management.

Target devices for device management

For device management, you can view the device status and many types of information by collecting information from devices connected to the network. Examine the devices for which you want to view the current status in the organization.

Device management is applicable to devices that have IP addresses, such as computers with OSs, network printers, and routers. To perform device management, you must register the devices as JP1/IT Desktop Management 2 management targets. One license is used to manage one device.

You can search for any device having an IP address in the network to automatically collect information. Therefore, even if devices in a department are unknown, you can use JP1/IT Desktop Management 2 to collect information for the devices in the organization and add them as management targets. For devices without IP addresses, such as offline computers, use offline management or manage them as assets.

Peripheral devices for computers, such as a mouse and keyboard, can be managed as part of device information by entering information for the peripheral devices as additional information. Therefore, no licenses are used for managing peripheral devices.

If you do not want to use JP1/IT Desktop Management 2 to manage some devices in the organization, register them as exclusion targets. For example, if you only want to manage the devices which are subject to security control, register devices such as network printers and routers as exclusion targets. This allows you to collect information only from the managed devices.

Device management targets are determined as follows:

Devices to be managed by collecting information:

Register the devices as management targets. One managed device uses one licence.

Devices not to be managed:

Register the devices as exclusion targets (uses no license).

Devices subject to security control

For security control, you can view the security status of devices and take corrective actions based on the information collected from the managed devices. Examine the devices for which you want to maintain security.

Security control is applicable to managed computers running Windows.

By installing agents in computers, you can judge and diagnose the security status and take security measures.

Agentless computers can also be subject to security control, provided that administrative share is enabled and you can log on as a member of the Administrators group. Note, however, that you can judge and diagnose the security status of an agentless computer only within the range of device information that can be acquired. Security judgement and diagnosis are not possible for some information. There are also functional restrictions. For example, the auto enforce function and the software startup suppression function cannot be used.

Security control targets are determined as follows:

To automatically apply security measures:

Computers with agents installed are subject to security control.

To judge and diagnose the security status:

Computers running Windows are subject to security control. Functions are restricted on agentless computers.

Target devices for asset management

For asset management, you can manage the status of devices owned by the organization (hardware assets), no matter whether they are connected to the network. Analyze the devices which you want to manage as assets in the organization. No licenses are used for managing hardware assets.

Asset management is applicable to all devices owned by the organization. Because you can register any asset information, you can manage peripheral devices and devices without IP addresses.

Of the devices owned by the organization, register the devices you want to manage as hardware assets with asset numbers assigned. By registering the devices as hardware assets, you can manage the asset status (indicating whether the asset is in use or in stock), user name, contact phone number, and related contract information, in addition to asset numbers.

Hardware asset information is automatically registered for devices that are added asJP1/IT Desktop Management 2 management targets. To manage devices as assets rather than adding them as management targets, you must register hardware asset information manually.

(1) Managing device information for online managed computers

To correctly manage device information in the organization where devices increase or decrease on a daily basis, you need to periodically perform a search and register all devices to be managed. The managed device information must be kept up to date.

To manage device information, you need to decide on a search range, search schedule, and whether to install agents on computers discovered by a search. You also need to set up an operation schedule to collect and update device information for computers.

Analyzing device search requirements

Consider the following items related to device search.

Search range

Decide the ranges for device searches. Because the IP addresses to be searched for are specified during setup, determine the ranges of IP addresses of the devices to be searched for.

You can specify multiple search ranges. We recommend that you specify only ranges of IP addresses used in the organization. Because connection is attempted to all IP addresses in the specified range, if you specify a search range that contains unused IP addresses, a long time will be required until the search completes.

Search schedule

Decide when to perform device searches. If you plan to perform device searches on a regular basis, decide the search start time and the date. You can set a schedule by specifying a day of the week and time to perform a search, for example, at 8:00 on the first Monday of every month.

Turned-off devices cannot be discovered by a search. Therefore, for the first week after installation of JP1/IT Desktop Management 2, set up the system to repeatedly perform searches so that all devices will be discovered. When all necessary devices have been registered, set up a search schedule based on a consideration of how frequently devices are installed in the organization.

Setting and allocation of authentication information

To collect information such as the device type and OS during a search, you need to register authentication information used for searches. A search uses two types of authentication information: SNMP and Windows administrative share.

SNMP authentication information

Register a community name for using SNMP to connect a device.

If a community name has not been set in the network, public is set as the community name. Because authentication information with public assigned is registered by default, you do not need to register SNMP authentication information if no community name has been set.

Authentication information for Windows administrative share

Register an ID and password used to access Windows administrative share.

You can specify the registered authentication information to be used for each search range. If the computer authentication information varies for different search ranges, you need to register the necessary authentication information and set it for each search range.

If no authentication information is registered, you cannot collect device information during a search, but can only confirm the existence of devices.

Operation on discovered devices

Decide which action should be performed when a new device is discovered by a device search. The following actions can be performed.

Automatically add the discovered devices as management targets

Computers that are recognized by a search as Windows OS devices are automatically added as management targets.

Automatically install agents on discovered devices

When an agent is installed on a computer, that computer is automatically added as a management target and becomes subject to security control.

To install an agent on a computer, authentication information for Windows administrative share must be registered and allocated.

Deciding collection and update intervals for device information

Decide how to collect and update device information during operation. How device information should be updated varies depending on whether an agent is installed on a managed computer.

For a computer with an agent installed

The agent collects computer information, and then reports it to the management server on a regular basis. This allows the computer information retained by the management server to be refreshed automatically.

In addition to automatic collection, you can collect computer information at any time.

For an agentless computer

An agentless computer cannot report information to the management server automatically. Therefore, the device information on an agentless computer is configured to be collected and updated on a regular basis. By default, the device information is collected once every hour.

If there are many agentless computers and collecting information places load on the network, specify a collection interval that is appropriate for your environment.

More detailed information can be collected and managed for a computer with an agent installed than for an agentless computer. Consider installing agents. Also, consider how to update device information.

(2) Applying security measures to online managed computers

Decide how to set security policies considering the organization's security rules. Also determine the judgment schedule based on the security policies, and set the calculation targets and storage period for reports created as a result of security diagnosis.

Applying security policies

By default, the default policy is applied to the managed computers. If there is only one set of rules in the organization, you can change the security policy settings for all computers by editing the default policy. If some computers require special security policies, mainly use the default policy and create special security policies.

In addition, decide security policy details (security configuration items and action items).

Deciding security judgment items and automatic application of security measures

Decide which judgement items should be set for a security policy based on the organization's rules, and determine which security measures should be automatically applied to violations.

Deciding actions to be taken against security policy violations

Decide the action to be taken if a security policy violation is found. You can select from the following actions.

Notify the user of a security policy violation.

Deny network connection of the computer that has a security problem.

Setting up the security judgment schedule

The security status is determined at a regular interval based on the specified security policy. Use the Settings module to specify the time of security status judgment appropriate for operations.

Considerations related to calculation of security diagnostic reports

The results of a security status judgment can be calculated in a security diagnostic report. Decide the calculation period and storage period for security diagnostic reports.

Calculation period

You can check the security status using periodic security diagnostic reports in addition to checking the current status. You can specify the period as weekly, monthly, quarterly, half yearly, or yearly. Use the Settings module to specify the calculation start date appropriate for the operation in the organization.

Storage period

You need to decide how long the calculated security diagnostic reports will be stored. You can specify the storage period in a range from 1 to 10 years.

(3) Managing asset information

You can manage a variety of assets owned by the organization. Consider the management target for each type of asset information.

Hardware assets

Information about the devices, such as computers, servers, printers, network devices, and USB devices, can be managed as hardware asset information. In addition to detailed asset information, you can manage the status indicating that the asset is in use, in stock, or disposed of. Thus, you can see the status of the hardware assets in the organization.

Determine which hardware assets owned by the organization you want to manage by using JP1/IT Desktop Management 2. Then, provide information on the assets.

Tip

If you have an asset register at hand, you can register the asset information by importing the asset register.

In JP1/IT Desktop Management 2, assets are managed by using BIOS serial numbers to associate assets with device information. If multiple devices have the same BIOS serial number, device information cannot be correctly associated. For details on methods other than using BIOS serial numbers to associate device information, see the procedure for changing the device information association in the JP1/IT Desktop Management 2 Administration Guide.

Software licenses

You can manage information about the software licenses owned by the organization. Computers permitted to use them can also be managed.

To manage the software licenses, register information about software license certificates. Provide the certificates for the software licenses owned by the organization.

The software type can be used as a judgment condition when you consider whether to manage software licenses. For example, you can choose to manage only the licenses for the software whose software type is commercial software.

Managed software

You can register a software product corresponding to a software license to manage the license used for each software product. In addition to managing the total number of licenses, you can allocate a license to each computer to find computers that use licenses without permission.

You must confirm in advance which software products currently in use correspond to which software licenses.

Contracts

You can register contract information about hardware assets and software licenses, such as support contracts, rental contracts, and lease contracts, and then manage the contract information associated with asset information. Because you can view information about the contracts that are about to expire, you can create a work schedule.

To manage contract information, register information about contract documents. Provide contract documents related to the hardware assets and software licenses owned in the organization.

Handling management items

You can create original management items as additional management items. You can also add options to the existing management items. If you want to individually manage information in the organization, you must first determine which management items should be created.

Tip

Before you attempt to import and register asset information, confirm the management items contained in the data to be imported. To manage items that do not exist in JP1/IT Desktop Management 2, you need to create management items before importing asset information.

4.6.4 Creating groups

You can manage devices and hardware assets in groups. First, you need to determine what type of grouping to use, and how you wish to create the groups.

When you create groups, you can perform the following tasks at the group level:

Assign security policies (excluding host-name-of-the-management-relay-server groups)

Assign a computer to perform distribution

Define the scope of reports (excluding user-defined groups)

Assign agent configurations (excluding user-defined groups host-name-of-the-management-relay-server groups)

The following table describes the types of group and how each group type is managed.

Type

Management method

Device type

Computers are grouped based on operating system information collected from the computer. Devices other than computers are grouped automatically based on their device type.

Network

Computers are grouped by network segment based on IP address information collected from the computer.

Department

Computers are automatically grouped based on the department and location information collected from the computer. In a multi-server configuration, computers are also automatically grouped when asset field definitions are applied from the higher management server. The administrator can also manually assign computers to groups. When linking with Active Directory, the department information managed by Active Directory can be reflected directly to the group configuration.

Location

User-defined

Devices are assigned to groups automatically based on the conditions set by the system administrator.

Host name of the management relay server

In a multi-server configuration, computers are automatically grouped based on the host name information collected from lower management relay servers. Network segments that are defined in a management relay server are put into a group with the same name as the management relay server.

The following describes the matters you must consider when creating groups:

Types of group

In the following circumstances, devices must be managed in user-defined groups. When using user-defined groups, you also need to consider the structure of the groups.

You want to manage groups using the value of an added management item as the allocation criteria

You want to manage groups using added management items and system groups (device type, network, department, or location) as the allocation criteria

By default, the relevant groups are not created automatically when you group devices by department and location. You need to decide the structure of the groups.

When you group devices by device type and network, groups are created automatically based on the information collected from devices. In this case, you do not need to consider the group structure.

Group structure

When using user-defined groups, consider the criteria you want to use to allocate devices to groups.

Department and location groups can be managed in a tree structure. Consider what group structure would be appropriate in light of the departmental framework of your organization and how devices are physically distributed throughout it. When linking with Active Directory, consider whether to incorporate the group configuration managed by Active Directory as department information.

Creating groups

User-defined groups are created by the system administrator, who sets the conditions for allocating devices to the groups. For details about how to create user-defined groups, see (20) Creating groups. For details about the structure of user-defined groups, see (22) Overview of user-defined groups.

There are two methods to create groups of departments and locations:

Group creation by collecting device information

Groups are created based on the user information collected from computers. To collect user information from computers, the department and location configurations must be set in advance in the Settings module on the management server. Note that user information can only be collected from computers with agents installed.

You can also use the group configuration managed by Active Directory as department information. To do so, enable the import of group configurations when you configure Active Directory linkage in the Settings module.

You can also automatically group computers based on the registry information collected from the computers.

Group creation by the administrator

You can group computers manually by defining the department and location configuration in the Settings module on the management server.

Tip

During initial setup, we recommend that you group devices automatically based on the collected device information. Manual grouping should be used to modify an existing group configuration, rather than during initial setup.

4.6.5 Analyzing management options required in a multi-server configuration

This section describes some points to be considered before you operate JP1/IT Desktop Management 2 in a multi-server configuration.

Analysing a hierarchical structure

In view of departments and network configurations of the system you want to manage, analyze the following items regarding a hierarchical structure of the multi-server configuration:

The number of management relay servers to be installed

To which server each management relay server is connected

The range of computers managed by each management server

Whether to provide a relay system

Note that if you operate a JP1/IT Desktop Management 2 system in a NAT environment, you need to provide a management relay server under the NAT device.

For details on multi-server configurations, see 4.4.3 Multi-server configuration.

Analyzing license holding options for each management server and the range of shared licenses

If you want to use each management server to manage the number of product licenses of JP1/IT Desktop Management 2 that are held by or remaining in each management server, consider the license holding options of each management server and the ranges of shared licenses. If you want to limit the number of devices that can be managed by each management server, distribute the product licenses on the primary management server to each management relay server. If you want to register a product license (purchased under a contract different from the one on the primary management server) on a management relay server, authorize product license registration for the management relay server.

For details on how to manage product licenses in a multi-server configuration, see 3.3 Managing product licenses in a multi-server configuration.

Analyzing which management server manages operation logs

Consider which management server collects operation logs and which management server stores operation logs to accommodate multi-server configuration system operations. Also consider whether the operation logs collected by each management server are to be reported to the higher management server.

For details on how to manage operation logs in a multi-server configuration, see 2.18.11 Managing operation logs in a multi-server configuration.

Analyzing which management server manages the revision history

Consider which management server in the multi-server configuration manages the revision history. Based on the decision, consider whether each management server collects the revision history for devices that are not directly under the server. We recommend that you do not collect revision history for those devices if the management server is operated under a NAT environment without the attendance of an administrator, or if you want to distribute loads among the management servers.

For details on how to manage revision history in a multi-server configuration, see (6) Collecting revision history of the devices managed by management relay servers under the local server.

Analyzing which management server manages asset information

Consider which management server in the multi-server configuration manages the asset information.

For details on how to manage asset information in a multi-server configuration, see 2.18.12 Managing assets in a multi-server configuration.

4.6.6 Analysis of network monitoring requirements

To prevent information leaks and virus infections caused by unauthorized devices brought into the network, use network monitoring to prevent unauthorized devices from being connected to the organization's network.

You must determine the network monitoring methods, the networks to be monitored, and the devices permitted for network connection.

Determining the network monitoring method

There are two network monitoring methods as described below. Decide which method you should use.

Blacklist method

This method specifies the devices that are prohibited from connecting to the network. This blocks network connection of the registered devices. Other devices are permitted to connect to the network. Use this method if you want to generally permit network connection and prohibit network connection only when an unauthorized device is found.

When using the blacklist method, we recommend that you enable all automatic updates of the network control list. By doing so, you can ensure that no superfluous information remains on the network control list. If you enable automatic updates only for add operations, superfluous information remains in the network control list, creating a need for manual maintenance by the system administrator.

For details about how to configure automatic update of the network control list, see the description of editing the automatic update of the network filter list in the JP1/IT Desktop Management 2 Administration Guide.

Whitelist method

This method specifies the devices permitted for network connection in advance. The registered devices can connect to the network. Network connection attempted from any other devices is automatically blocked. Use this method if you want to ensure robust security for network connection of devices.

When using the whitelist method, by enabling all automatic updates of the network control list, you can automatically prevent sharing of NICs (including wireless LAN cards). However, depending on exactly when automatic updates are enabled, devices might be prevented from accessing the network. If you enable automatic updates only for add operations, you can prevent NIC sharing by making maintenance of the network control list the responsibility of the system administrator.

For details about how to configure automatic update of the network control list, see the description of editing automatic update settings in the JP1/IT Desktop Management 2 Administration Guide.

Tip

You can specify the monitoring method for each network segment.

Deciding the network segments to be monitored

Because a network monitor is installed in each network segment, you must decide which network segments in the organization will be monitored.

To monitor the network, you must install computers with the network monitor enabled in the target network segments. A single computer with the network monitor enabled can monitor multiple network segments if that computer can use multiple network cards to connect to multiple networks. Network monitoring takes effect as long as the network monitor is running. Therefore, ensure that the network monitor is enabled on a computer that runs 24 hours a day and on which an agent can be installed.

Deciding the devices subject to network connection control

Devices you should decide vary depending on the network monitoring method.

For the blacklist method:

Determine the devices that are to be prohibited from connecting to the network. Check the IP addresses and MAC addresses used for registering the devices manually.

For the whitelist method:

Use the network search function or install agents to discover all devices to be permitted for network connection. Note that if the network monitor is enabled on a computer, devices that exist in that network segment will automatically be discovered.

Tip

Use one of the following methods to register the devices subject to network connection control.

Use the network search function or network monitor to discover devices (devices are automatically registered).

Connect a computer with an agent installed (devices are automatically registered).

An administrator registers devices manually.

Tip

Because the whitelist method requires you to extract all devices that will be permitted for network connection, operation is difficult at the beginning. You can also use the blacklist method to monitor the network in an early stage of operation, and then change the method to the whitelist method after all devices have been extracted.

Tip

When you use the network monitor, all computers permitted for network connection must be registered as management targets. Devices other than computers need not be management targets.

Quarantine communication

You can set up a device to which devices blocked from the network can connect. Consider the devices appropriate for the operation methods of the organization.

For example, you might set up a security measurement server. This allows computers that have been automatically blocked due to insufficient security measures to connect to the management server and security measurement server. You can also configure the computers to use a troubleshooting tool from the security measurement server and then automatically connect to the network when the security is ensured.

4.6.7 Analyzing periodic maintenance needs

We recommend that you perform the following maintenance during operation. Decide when maintenance should be performed.

Back up operation data

Back up operation data including the database and data files. If a disk error occurs, information on the management server might be lost or the management server might no longer operate.

Therefore, create a backup on a regular basis during operation. If an error occurs in the management server, you can use the backup to restore the state that existed when the backup was created.

Reorganize the database

Long term operation of the database might cause problems such as fragmented areas, degraded storage efficiency, and reduced access speed. To prevent such problems, a function that reorganizes the database is provided. By reorganizing the database, you can change the storage configuration without changing the data contents, thus providing more efficient performance.

Reorganize the database regularly.

Decide when and at what interval you should back up operation data and reorganize the database. To create a backup or reorganize the database, you need to stop the management server. Therefore, when creating a schedule, choose a day of the week and time when the management server is not used.

Tip

We recommend that you create a backup or reorganize the database on a regular basis.

Use one of the following methods to perform maintenance on the management server.

Anytime you wish

You can manually perform maintenance anytime your wish by using the database manager or by executing a command.

Scheduled maintenance

Register the command as a Windows task, and then set a schedule to execute the command automatically.

To perform maintenance by using the database manager:

From the Start menu on the management server, start the database manager.

In the dialog box that appears, select the menu item you want to execute.

Follow the instructions in the database manager window to perform maintenance.

Maintenance is completed.

To perform maintenance by using commands:

Use the stopservice command to stop the management server.

Perform maintenance.

To back up operation data:

Use the exportdb command to create a backup.

To reorganize the database:

Use the reorgdb command to reorganize the database.

Use the startservice command to start the management server.

Maintenance is completed.

Important

If the management server in a single-server configuration or the primary management server in a multi-server configuration is in a cluster configuration, use the cluster software function to start and stop cluster resources on the management server.

If the management server is not in a cluster configuration, you can also use the exportdb or reorgdb command with the -a option specified to perform maintenance. In this case, perform only step 2 above. Steps 1 and 3 are automatically performed.

Tip

If an error occurs on the management server, you can restore the data by using the importdb command with the backup data specified as an argument. You can also back up, restore, and reorganize the database by using the database manager.

4.6.8 Notes when running anti-virus software

If JP1/IT Desktop Management 2 and anti-virus products are installed on the same host, remove the following files and folders from the virus-check target.

If you run a virus check while JP1/IT Desktop Management 2 is stopped and then restart JP1/IT Desktop Management 2, confirm that the following files and folders were checked for viruses.

JP1/IT Desktop Management 2 - Manager files and folders

All files and folders in JP1/IT Desktop Management 2-Manager-installation-folder

Database folders, data folders, and local data folders that were defined in the setup

Database folders for operation logs that were defined during setup

Folder to which operation logs are automatically saved as defined during setup

Output-destination folder that is used when operation logs and asset information are exported

JP1/IT Desktop Management 2 - Agent files and folders

In Windows:

All files and folders in JP1/IT Desktop Management 2-Agent-installation-folder

All files and folders in JP1/IT Desktop Management 2-Agent-installation-drive\JP1ITDMWK\

%WINDIR%\JP1ITDM\UtilMsg.dll

%WINDIR%\jdnagent.nid

All files and folders in %ALLUSERSPROFILE%\Hitachi\jp1itdma\

%SystemRoot%\jdngshare.dll

%SystemRoot%\jdngsrv.exe

All files and folders in JP1/IT Desktop Management 2 - Network Monitor-installation-folder

In HP-UX#

All files and directories in /etc/opt/NETMDMW/

All files and directories in /opt/NETMDMGF/

All files and directories in /opt/NETMDMW/

All files and directories in /opt/NETMDMWEX1/

All files and directories in /var/opt/NETMDMW/

All files and directories in /NETMDMGF/

In AIX and Solaris#

All files and directories in /opt/NETMRDS/

All files and directories in /opt/NETMRDSEX1/

All files and directories in /opt/NETMDMGF/

In Linux#

All files and directories in /opt/NETMDMGF/

All files and directories in /opt/NETMDMW/

All files and directories in /opt/NETMDMWEX1/

In Mac OS#

All files and directories in /Library/Application Support/jp.co.hitachi.jp1itdm2/

#: If you previously changed the work directory by performing the applicable procedure in the manual JP1/IT Desktop Management 2 - Agent (for UNIX systems), be sure to remove the current work directory from the virus-check target.

JP1/IT Desktop Management 2 - Internet Gateway files and folders

All files and folders in JP1/IT Desktop Management 2 - Internet Gateway-installation-folder

For details on the folders to be removed from the virus-check target, see the following manuals:

Appendix A.1 List of folders and Appendix A.2 List of services and processes

List of folders and List of services and processes in the manual JP1/IT Desktop Management 2 Overview and System Design Guide.

File Structures in JP1/IT Desktop Management 2 - Agent in the manual JP1/IT Desktop Management 2 - Agent (For UNIX Systems).

Important

If you do not remove the files and folders from the virus-check target, file access errors might occur, because the files and folders used by JP1/IT Desktop Management 2 will be in use by the anti-virus products. If such an error occurs, errors in JP1/IT Desktop Management 2 operations might occur or processes might be forcibly terminated. As a result, problems such as the following might occur:

Attempts to back up the database might fail.

JP1/IT Desktop Management 2 might not be able to collect inventory information and operation logs, or to distribute software.

Processing to upload or download files in Internet Explorer might be delayed, or Internet Explorer might stop.

Processing to export operation logs and asset information might be delayed, taking a long time to finish.

The network monitor might not be able to detect devices, and users might not be able to perform operations to permit or block network connections.

An error might occur when a component is registered.

The execution of Remote Installation Manager jobs might be delayed.

Appendixes

A. Miscellaneous Information

This appendix provides miscellaneous information about using JP1/IT Desktop Management 2.

A.1 List of folders

Folders created on the management server

The following table shows the folders that are created on the management server when JP1/IT Desktop Management 2 - Manager is installed. Do not change the folder (subfolder) names or file names.

Folder name

Description

JP1/IT Desktop Management 2-Manager-installation-folder

JP1/IT Desktop Management 2 data folder

%WINDIR%\Temp\JDNINST

Folder for log files which are output during installation

The following table shows the folders that are created in JP1/IT Desktop Management 2-Manager-installation-folder.

Folder name

Description

log\

Log file follder

mgr\

Root folder for the management server

mgr\backup\

Default backup folder

mgr\bin\

Executable file folder

mgr\conf\

Environment definition file folder

mgr\db\

Database installation folder

mgr\dbclt\

Folder for the installer of the database's ODBC driver

mgr\definition

Linkage definition file folder

mgr\doc\

Online manual folder

mgr\download\

Installation set folder

mgr\endorsed\

Java standard library replacement file folder

mgr\gui\

J2EE application folder

mgr\license\

License file folder

mgr\log\

Trace log folder

mgr\nma\

Network monitor agent folder

mgr\ospatch\

Updated program information file folder

mgr\script\

Agent script file folder

mgr\Setup_Input\

Database setup input file folder

mgr\Setup_Input_HA\

Folder for the database setup input files used for a cluster configuration

mgr\temp\

Temporary data folder

mgr\tools\

Tool folder

mgr\troubleshoot\

Default troubleshooting information folder

mgr\uCPSB\

Application server installation folder

The following table shows the folders that are created during installation or setup of JP1/IT Desktop Management 2 - Manager (other than in the installation folder).

Folder name

Description

%ProgramFiles%\Hitachi\HNTRLib2\

Trace library installation folder

All-User-profile-application-data-folder\Hitachi\jp1itdmm\Database\#

JP1/IT Desktop Management 2 data folder

All-User-profile-application-data-folder\Hitachi\jp1itdmm\LocalData\#

Local disk work folder

program-menu-of-the-system\JP1_IT Desktop Management 2 - Manager\

Program folder.

When the program folder is installed as a management relay server in a multi-server configuration, the Agent folder is created as a subfolder.

#: This folder name is set by default when the product is provided. The folder is created during setup.

Folders created for the Remote Install Manager

The following table shows the folders that are created on a computer on which Remote Install Manager is installed. Do not change the folder (subfolder) names or file names.

Folder name

Description

Remote Install Manager-installation-folder

Folder for the Remote Install Manager data

%WINDIR%\Temp\JDNINST

Folder for log files that are output during installation

The following table shows the folders that are created in Remote Install Manager-installation-folder.

Folder name

Description

log\

Log file follder

mgr\

Root folder for Remote Install Manager

mgr\bin\

Executable file folder

mgr\dbclt\

Folder for the installer of the database's ODBC driver

mgr\license\

License file folder

mgr\RMTINS\

Folder for Remote Install Manager-related files

mgr\temp\

Temporary data folder

mgr\troubleshoot\

Default troubleshooting information folder

The following table shows the folder (except the installation folder) that is created when Remote Install Manager is installed or set up.

Folder name

Description

program-menu-of-the-system\JP1_IT Desktop Management 2 - Manager\

Program folder

Folders created on the Internet gateway server

The following table describes the folders created on the computer on which an Internet gateway is installed.

Folder name

Description

folder-in-which-an-Internet-gateway-is-installed

Folder for the Internet gateway data.

%WINDIR%\Temp\JDNINST

Folder for log files that are output during installation

The following table describes the folders created under the folder-in-which-an-Internet-gateway-is-installed:

Folder name

Description

igw\

Root folder for Internet gateway

igw\bin

Executable file folder

igw\Web

Internet publication folder.

log\

Log file follder

The following table describes the folder created when an Internet gateway is installed or set up (not the one in which the Internet gateway is installed):

Folder name

Description

program-menu-of-the-system\JP1_IT Desktop Management 2 - Internet Gateway\

Program folder

A.2 List of services and processes

The tables below list the JP1/IT Desktop Management 2 services and corresponding service processes. They also provide a short description of the services and note whether the services start automatically.

List of JP1/IT Desktop Management 2 - Manager services

Service name

Service display name

Service process name

Description

Automatic startup of the service

JP1_DTNAVI_AGCTRL

JP1_ITDM2_Agent Control

JP1/IT Desktop Management 2-Manager-installation-folder\mgr\bin\jdnagcadm.exe

Agent control service

Yes

JP1_DTNAVI_MGRSRV

JP1_ITDM2_Service

JP1/IT Desktop Management 2-Manager-installation-folder\mgr\bin\jdnmsservice.exe

Manager service

Yes

JP1_DTNAVI_RLYMGRSRV

JP1_ITDM2_Relay Manager Service

JP1/IT Desktop Management 2-Manager-installation-folder\mgr\bin\jdnrelaymgrsrv.exe

Relay service for the management server

Yes#

JP1_DTNAVI_WEBCON

JP1_ITDM2_Web Container

JP1/IT Desktop Management 2-Manager-installation-folder\mgr\bin\jdnwebcon.exe

Application server service

Yes

JP1_DTNAVI_WEBSVR

JP1_ITDM2_Web Server

JP1/IT Desktop Management 2-Manager-installation-folder\mgr\uCPSB\httpsd\httpsd.exe

Web server service

Yes

HiRDBEmbeddedEdition_JE1

JP1_ITDM2_DB Service

JP1/IT Desktop Management 2-Manager-installation-folder\mgr\db\BIN\pdservice.exe

Management server database service

Yes

HiRDBClusterService_JE1

JP1_ITDM2_DB Cluster Service

JP1/IT Desktop Management 2-Manager-installation-folder\mgr\db\BIN\pdsha.exe

Cluster service of the management server database

No

Hntr2Service

Hitachi Network Objectplaza Trace Monitor 2

%Program files%\Hitachi\HNTRLib2\bin\hntr2srv.exe

Log output service

No

Legend: Yes: The service starts automatically, No: Does not start automatically

Note that no services start automatically in a cluster configuration because services are manipulated by using the cluster software functions.

#: This service is automatically started in a multi-server configuration. It is not automatically started in a minimum configuration or basic configuration.

List of JP1/IT Desktop Management 2 - Network Monitor services

Service name

Service display name

Service process name

Description

Automatic startup of the service

NXNetMonitor

JP1_ITDM2_Network Monitor

%ProgramFiles%\Hitachi\jp1itdmn\nma\bin\nxnmsvc.exe

Network monitor service

Yes

Legend: Yes: The service starts automatically

List of JP1/IT Desktop Management 2 - Agent and agent for the management relay server services

Service name

Service display name

Service process name

Description

Automatic startup of the service

jdngsrv

JP1_ITDM2_Agent Service

%SystemRoot%\system32\jdngsrv.exe

Agent services

Yes

jdngsmcsrv

JP1_ITDM2_Agent Monitor Control

In the case of an agent:

JP1/IT Desktop Management 2 - Agent-installation-folder\bin\jdngsmcsrv.exe

In the case of an agent for the management relay server:

JP1/IT Desktop Management 2 - Agent-installation-folder\mgr\bin\jdngsmcsrv.exe

Operation monitoring service

Yes

jdngrcagent.exe

JP1_ITDM2_Agent Remote Control

In the case of an agent:

JP1/IT Desktop Management 2 - Agent-installation-folder\bin\jdngrcagent.exe

In the case of an agent for the management relay server:

JP1/IT Desktop Management 2 - Agent-installation-folder\mgr\bin\jdngrcagent.exe

Remote control agent service

Yes

Legend: Yes: The service starts automatically

The following table lists and describes the resident processes on a computer on which JP1/IT Desktop Management 2 - Manager is installed. Processes are shown in alphabetical order of their names.

List of processes

Process name

Function

Whether the process is resident

cjstartsv.exe

Application server process

Yes

cprfd.exe

Application server process

Yes

httpsd.exe

Web server function process

Yes

jdnagcadm.exe

Service process

Yes

jdnagcmain.exe

Service process

Yes

jdndmpadm.exe#1

Service process

Yes

jdngschserv.exe

Service process

Yes

jdngsite.exe#1

Service process

Yes

jdngsrvmain.exe

Service process

Yes

jdnmscontroller.exe

Service process

Yes

jdnmsplugincontroller.exe

Service process

Yes

jdnmssecurityctrl.exe

Service process

Yes

jdnmssecuritysplit.exe#2

Service process

Yes

jdnmsservice.exe

Service process

Yes

jdnrelaycontroller.exe#1

Service process

Yes

jdnrelaymgrsrv.exe#1

Service process

Yes

jdnwebcon.exe

Application server process

Yes

Legend: Yes: Resident process

#1: This process is resident on the management relay server.

#2: This process is resident only if you select 16GB for Cache size when accessing the database in the server configuration when you set up the management server.

List of database processes

Process name

Function

Whether the processes are resident (Number of resident processes)

Number of processes

pdservice.exe

HiRDB service process that controls the process server

Yes

1

pdprcd.exe

Process server process that manages HiRDB-related processes

Yes

1

pdrsvre.exe

Post-processing process that handles post-processing of an abnormally-terminated process

Yes

1 to 4

pdmlgd.exe

Message log server process that controls message output

Yes

1

pdrdmd.exe

System manager process that manages startup and stoppage of units and connected users

Yes

1

pdstsd.exe

Status server process for input and output of the status files for units

Yes

1

pdlogd.exe

Log server process that controls log-related processes and acquisition of system logs

Yes

1

pdscdd.exe

Scheduler process that assigns transactions to single server processes

Yes

1

pdtrnd.exe

Transaction server process that controls transactions

Yes

1

pdtrnrvd.exe

Transaction recovery process that controls settlement and recovery of a transaction

Yes (1)

1 to 673

pd_buf_dfw.exe

Deferred write process that writes data to the database storage disk

Yes

1

pdlogswd.exe

Log swap process that assigns and releases system log-related files, manages input and output of those files, and acquires synchronization point dumps

Yes

1

pdsds

Single server process that handles SQL processing

Yes (20)

1 to 350

pdxxx#

Processes other than pdsds, including utility processes and the database's internal processes

No

--

Legend: Yes: The process is resident. No: The process is not resident. --: The number of processes depends on the process.

#: xxx is a character string that contains 3 to 8 characters.

A.3 Port number list

This section describes the port numbers used by JP1/IT Desktop Management 2.

If not otherwise specified, "management server" includes "primary management server" and "management relay server".

Tip

All port numbers used by JP1/IT Desktop Management 2 - Manager are the same as those used by JP1/IT Desktop Management 2 - Operations Director.

JP1/IT Desktop Management 2 - Manager port number list

Management server

Port number for management server

Connection direction

Connected to [port number]

Protocol

Use

Ephemeral

The JP1/Base authentication server [20240]

TCP

Used for communication from a management server to the authentication server when authenticating JP1 users.

31080

Administrator's computer [ephemeral]

TCP

Used for communication from an administrator's computer to a management server when the operation window is referenced or used.

This port number is also used for communication from Remote Install Manager or Packager, or network control command installed on the administrator's computer to a management server.

31000

Agent, relay system or internet gateway [ephemeral]

TCP

Used for communication from an agent, relay system or an internet gateway to a management server

31002

Remote Install Manager or management server [ephemeral]

TCP

Used for communication from a remote Install Manager to a management server.

Ephemeral

Management relay server, agent or relay system [31001]

TCP

Used for communication from a management server to a management relay server, agent or relay system during distribution using Remote Install Manager

31006 to 31009, 31011 to 31013

Management server [ephemeral]

TCP

Used for communication for internal processing within a management server.

31010

Remote Install Manager [ephemeral]

Asset Console (jamTakeITDM2Info.exe) [ephemeral]

TCP

Used for communication from Remote Install Manager or Asset Console to a management server, or internal processing

ephemeral

Management relay server, agent, or relay system [31001]

UDP

Used for controlling the power source by using Wake on LAN.

Ephemeral

Agent or relay system [31014]

UDP

Used for communication from a management server to an agent or relay system to distribute jobs by multicasting

31015

Agent or relay system [ephemeral]

UDP

Used for communication from an agent or relay system to a management server for requesting retransmission during multicast distribution

31021

Remote Install Manager [ephemeral]

Agent [ephemeral]

Relay system [ephemeral]

Packager [ephemeral]

Management relay server [ephemeral]

Management server [ephemeral]

Internet gateway [ephemeral]

TCP

Used for communication from Remote Install Manager, agent, relay system, Packager, management relay server, management server and internet gateway to a management server during distribution using Remote Install Manager

31023

Management server or management relay server [ephemeral]

TCP

Used for communication between a management server and a management relay server.

31026 to 31029

Management server [ephemeral]

TCP

Used for communication of internal processing performed on the management server when the API is used.

31030

External system [ephemeral]

TCP

Used for communication between the external system and the management server via the API.

Ephemeral

Management relay server, agent, or relay system [16992]

TCP

Used for controlling the power source of a computer that uses AMT

Each port number is set as a default when the product is provided. If the port numbers shown in the table are already used in the system environment you are using, in the setup, change them to port numbers that are not used.

If a management server controls port numbers by using Windows Firewall, specify firewall settings to enable the above ports. Also, specify firewall settings to enable ports used for communication in internal processing. Note that if you install JP1/IT Desktop Management 2 - Manager in an environment in which Windows Firewall is enabled, the ports are automatically set to pass through Windows Firewall (they are registered in the exception settings).

Administrator's computer (Remote Install Manager )

Port number for administrator's computer

Connection direction

Connected to [port number]

Protocol

Use

Ephemeral

Management server [31002, 31010, 31021, 31080]

TCP

Used for communication from Remote Install Manager to a management server during distribution using Remote Install Manager

Ephemeral#

Management server [ephemeral#]

TCP

Used for Remote Install Manager internal processing

Ephemeral

Relay system [31021]

TCP

Used when deleting a package on a relay system using Remote Install Manager.

#: The following describes how to fix the port numbers used for connecting the database to the agent.

To fix the port number of the management server (connection destination):

Execute the stopservice command to stop the services on the management server.

Use a text editor to open the pdsys file stored in JP1/IT Desktop Management 2 - Manager-installation-folder\mgr\db\CONF.

Add set pd_service_port = port-number. For port-number, specify the port number you want to use.

Example: To specify 10000 as the port number, enter as follows:

set pd_service_port = 10000

Execute the startservice command to restart the services on the management server.

To fix the port numbers of Remote Install Manager (connection destination):

For receiving ports, the OS automatically assigns port numbers by default. Ten or more receiving ports are used.

Stop Remote Install Manager and other applications for JP1/IT Desktop Management 2.

Use a text editor to open the HiRDB.ini file stored in Remote-Install-Manager-installation-folder\mgr\dbclt.

If Remote Install Manager and the management server are installed in the same computer, HiRDB.ini is stored in JP1/IT Desktop Management 2-Manager-installation-folder\mgr\dbclt.

For PDCLTRCVPORT=, specify the range of port numbers you want to use in the port-number-port-number format. Note that the range of port numbers is not set if you do not specify anything or specify 0 after PDCLTRCVPORT=, By default, the range of port numbers is not set.

Example: To specify 10000-10500 as the range of port numbers, enter as follows:

PDCLTRCVPORT=10000-10500

Start Remote Install Manager and other applications for JP1/IT Desktop Management 2.

Each port number is set as a default when the product is provided. If the port numbers shown in the table are already used in the system environment you are using, in the setup, change them to unused port numbers.

If the administrator's server controls port numbers by using Windows Firewall, specify firewall settings to enable the above ports. Note that if you install Remote Install Manager in an environment in which Windows Firewall is enabled, the ports are automatically set to pass through Windows Firewall (they are registered in the exception settings).

Port number list for a relay system

Port number for relay system

Connection direction

Connected to [port number]

Protocol

Use

16992

Management server [ephemeral]

TCP

Used for controlling the power source of a computer that uses AMT

31001

Management server [ephemeral]

TCP

Used for communication from a management server to a relay system during distribution using Remote Install Manager

31001

Management server [ephemeral]

UDP

Used for controlling the power source by using Wake on LAN.

31002

Agent [ephemeral]

Internet Gateway [ephemeral]

TCP

Used for communication from an agent and internet gateway to a relay system during distribution using Remote Install Manager

31014

Management server [ephemeral]

UDP

Used for communication from a management server to a relay system to distribute jobs by multicasting

31015

Agent [ephemeral]

UDP

Used for communication from an agent to a relay system for requesting retransmission during multicast distribution

31021

Remote Install Manager [ephemeral]

TCP

Used when deleting a package on a relay system using Remote Install Manager.

ephemeral

Management server [31015]

UDP

Used for communication from a relay system to a management server for requesting retransmission during multicast distribution.

Ephemeral

Management server [31021]

TCP

Used for communication from a relay system to a management server during distribution using Remote Install Manager

Ephemeral

Agent [16992]

TCP

Used for controlling the power source of a computer that uses AMT

ephemeral

Agent [31001]

UDP

Used for controlling the power source by using Wake on LAN.

ephemeral

Agent [31014]

UDP

Used for communication from a relay system to an agent during multicast distribution.

ephemeral

Agent [31001]

TCP

Used for communication from a relay system the agent, and distribution using Remote Install Manager.

Port number list for a controller and remote control agent

Controller or remote control agent [port number]

Connection direction

Connected server [port number]

Protocol

Use

Remote control agent [31016]

Controller [ephemeral]

TCP

Used for window operation from a controller to a remote control agent

Remote control agent [31017]

Controller [ephemeral]

TCP

Used for transferring files from a controller to a remote control agent

Remote control agent or controller [31018](when used as a chat server)

Remote control agent or controller [ephemeral]

TCP

Used for chat

Remote control agent [ephemeral]

Controller [31019]

TCP

Used for requesting a remote connection from a remote control agent to a controller

Remote control agent [ephemeral]

Controller [31020]

TCP

Used for callback file transfer from a remote control agent to a controller

controller [ephemeral]

RFB connection target device [5900]

TCP

Used for remote control by means of RFB connection.

controller [ephemeral]

Remote control agent[16992]

TCP

Used for controlling the power source of a computer that uses AMT

Controller [ephemeral]

Remote control agent [31016]

UDP

Used for controlling the power source by using Wake on LAN.

If a computer with a controller installed or a computer that is remotely controlled controls port numbers by using Windows Firewall, specify firewall settings to enable the above ports. Note that if a controller and remote control agent are installed in an environment in which Windows Firewall is enabled, the ports are automatically set to pass through Windows Firewall (they are registered in the exception settings).

Each port number is set as a default when the product is provided. If the port numbers shown in the table are already used in the system environment you are using, follow the steps below to change them to port numbers that are not used.

Port number for a controller

Specify port numbers in the Options dialog box of the controller.

Port number for a remote controller agent

Specify port numbers in the Remote control settings view used for agent configuration.

Port number for the chat functionality

In the Chat window, select Options, and in the displayed dialog box, in the Connect tab, specify the port numbers.

JP1/IT Desktop Management 2 - Agent port number list

Agent port number

Connection direction

Connected server [port number]

Protocol

Use

31001

Management server [ephemeral]

TCP

Used for communication from a management server to the agent, and distribution using Remote Install Manager

31001

Management server or relay system [ephemeral]

UDP

Used for controlling the power source by using Wake on LAN.

16992

Management server [ephemeral]

TCP

Used for controlling the power source of a computer that uses AMT

Ephemeral

Relay system [31002]

TCP

Used for communication from an agent to a relay system during distribution using Remote Install Manager

31014

Management server or relay system [ephemeral]

UDP

Used for communication from a management server or relay system to an agent to distribute jobs by multicasting

Ephemeral

Management server or relay system [31015]

UDP

Used for communication from an agent to a management server or relay system for requesting retransmission during multicast distribution

Ephemeral

Management server [31021]

TCP

Used for communication from an agent to a management server system during distribution using Remote Install Manager

31024

Agent [ephemeral]

TCP

Used for communication within an agent when an agent that communicates with a higher system via the Internet gateway communicates with the Internet gateway.

31025

Agent or management relay server [ephemeral]

TCP

Used for communication within an agent or management relay server when an agent or management relay server that communicates with a higher system via the Internet gateway communicates with the Internet gateway.

Ephemeral

Internet gateway [443]

TCP

Used for communication via the Internet gateway.

Each port number is set as a default when the product is provided. If the port numbers shown in the table are already used in the system environment you are using, when setting up a management server, change them to port numbers that are not used.

If a computer with an agent installed controls port numbers by using Windows Firewall, specify firewall settings to enable the above ports. Note that if an agent is installed in an environment in which Windows Firewall is enabled, the ports are automatically set to pass through Windows Firewall (they are registered in the exception settings).

If networks between JP1/IT Desktop Management 2 - Manager and JP1/IT Desktop Management 2 - Agent control ports by using Windows Firewall, specify firewall settings to enable the ports in the above table.

Port numbers for agentless devices

For agentless devices, the port numbers for Windows administrative shares or SNMP are used depending on the authentication status of the devices.

Port number list for an Internet gateway

Port number for Internet gateway

Connection direction

Connected to [port number]

Protocol

Use

443

Agent [ephemeral]

TCP

Used for communication via the Internet gateway.

A.4 Lists of parameters

This section describes the parameters used for installation and setup, and the parameters of the Settings module.

(1) Parameters used for installation

JP1/IT Desktop Management 2 - Manager installation

The following tables list and describe the parameters used for installing JP1/IT Desktop Management 2 - Manager.

Installation type

Item

Description

Specifiable values

Default

Installation Type

Select the installation method.

Quick installation

Custom installation

Quick installation

User registration (for custom installation)

Item

Description

Specifiable values

Default

User Name

Specify the name of the user who uses the product.

No limit

User name that was set during OS installation

Company Name

Specify the name of the company that uses the product.

No limit

Company name that was set during OS installation

Installation folder (for quick installation)

Item

Description

Specifiable values

Default

JP1/IT Desktop Management 2 - Manager Installation Folder

Specify the installation folder.

A path consisting of 40 or fewer characters#1

Folder specified for the %ProgramFiles(x86)% environment variable (if the OS is installed on the C drive, C:\Program Files(x86)\Hitachi\jp1itdmm\)

Database folder

Specify the folder in which the database is created.

A path consisting of 100 or fewer characters#2

All-User-profile-application-data-folder\Hitachi\jp1itdmm\

#1: Available characters are single-byte alphanumeric characters, single-byte spaces, periods (.), parentheses, underscores (_), and backslashes (\).

#2: Available characters are single-byte alphanumeric characters, single-byte spaces, hash marks (#), periods (.), parentheses, at marks (@), and backslashes (\).

Setting up the database (for quick installation)

Item

Description

Specifiable values

Default

User ID

Specify the ID of the user who uses the database.

A character string of 8 or fewer characters#

itdm2m

Password

Specify the password for the user ID.

A character string of 28 or fewer characters#

(Blank)

Confirm password

Re-enter the specified password for confirmation.

#: Available characters are single-byte alphanumeric characters beginning with an alphabet.

Installation folder (for custom installation)

Item

Description

Specifiable values

Default

JP1/IT Desktop Management 2 - Manager Installation Folder

Specify the installation folder.

A path consisting of 40 or fewer characters#

Folder specified for the %ProgramFiles(x86)% environment variable (if the OS is installed on the C drive, C:\Program Files(x86)\Hitachi\jp1itdmm\)

#1: Available characters are single-byte alphanumeric characters, single-byte spaces, periods (.), parentheses, underscores (_), and backslashes (\).

Custom installation (for custom installation)

Item

Description

Specifiable values

Default

Component to Install

Select the component to be installed and the installation method#1.

Manager#2

A component that provides main functions of JP1/IT Desktop Management 2, such as function management and security status management

Remote Install Manager#3

A component that provides GUI functionality for distribution management that uses the remote install manager

This component can be installed on a computer that is different from the Manager's computer. In such a case, install Remote Install Manager whose version is the same as Manager.

All components

#1: To install the component, click the icon on the left of the component name, and then select from the pull-down list. If you select This feature will not be available. in the pull-down list of the component name, the icon will change to the x icon.

#2: When you install Manager, you also need to install Remote Install Manager. If you have selected This feature will not be available. in the pull-down list of Remote Install Manager, you cannot install Manager.

#3: To install Remote Install Manager on a computer that is different from the Manager's computer, select This feature will not be available. in the pull-down list of Manager.

Type of Manager to be installed (for custom installation)

Item

Description

Specifiable values

Default

Type of Manager to Install

Select the type of the server on which JP1/IT Desktop Management 2 - Manager is installed.

The management server in a single-server configuration, or the primary management server in a multi-server configuration

The system is installed as the management server in a minimum configuration, or the management server in a basic configuration, or the primary management server in a multi-server configuration.

Management relay server

The system is installed as the management relay server in a multi-server configuration. The system cannot be installed on a computer on which JP1/IT Desktop Management 2 - Agent has been installed.

The management server in a single-server configuration, or the primary management server in a multi-server configuration

For large scale management

Check when managing more than 50,000 devices.

Selected

Manage 50,000 or more devices

Not selected

Do not manage 50,000 or more devices

Not selected

Note: This window is displayed when you select Manager in the Custom installation view (during custom installation).

Agent component settings (for custom installation)

Item

Description

Specifiable values

Default

Agent Component

Select the Agent component you want to install on the management relay server.

You need to specify the Agent component for the management relay server, aside from the managed computers.

Remote control agent

Packager

Automatic Installation Tool

Remote control agent

Note: This window is displayed when you select Management relay server in the Type of Manager to Install view (during custom installation).

Installation completed

Item

Description

Specifiable values

Default

Setup#1

Select whether to start setup after installation.

Selected

Setup is started.

Not selected

Setup is not started.

Selected

Automatic update of components#2

Specify whether to automatically distribute components (such as agents and network monitor agents) registered on the management server to computers if the components are updated.

Selected

Components are updated automatically.

Not selected

Components are not updated automatically.

Not selected

Register components as a distribution package#2

Specify whether to create component packages, which allow you to install updated components by using the distribution function.

Selected

Packages are created.

Not selected

Packages are not created.

Not selected

#1: Displayed if custom installation of Manager is performed.

#2: Displayed if setup is unnecessary when an overwrite installation is performed. In a cluster system, this item is displayed on the primary server.

JP1/IT Desktop Management 2 - Agent installation

The following tables list and describe the parameters used for installing JP1/IT Desktop Management 2 - Agent from the provided media.

Installation type

Item

Description

Specifiable values

Default

Installation Type

Select the installation method.

Quick installation

Custom installation

Quick installation

Installation folder (for custom installation)

Item

Description

Specifiable values

Default

JP1/IT Desktop Management 2 - Agent Installation Folder

Specify the installation folder.

A path consisting of 104 or fewer characters#

C:\Program Files\Hitachi\jp1itdma\

Note, however, that if the OS is a 64-bit version of Windows, the default folder is the folder specified for the %ProgramFiles(x86)% environment variable (if the OS is installed on the C drive, C:\Program Files (x86)\Hitachi\jp1itdmm\).

#: Available characters are single-byte alphanumeric characters, single-byte spaces, periods (.), parentheses, colons (:), underscores (_), and backslashes (\).

Types of components to be installed (for custom installation)

Item

Description

Specifiable values

Default

Types of components to be installed

Specify the types of components to be installed.

Agent

Relay system

Agent

Components to be installed (for custom installation)

Item

Description

Specifiable values

Default

Components to be installed

Select the component and its sub components to be installed, and the installation method#1.

Agent or relay system#2 (the type specified in the Types of components to be installed dialog box)

Packager

Automatic Installation Tool

Agent or relay system (the type specified in the Types of components to be installed dialog box)

#1: Select the installation method from the pull-down list that is displayed by clicking the icon on the left of the component name. If you select This feature will not be available. in the pull-down list, the icon will change to the x icon.

#2: The remote control agent is a subcomponent of an agent or relay system.

JP1/IT Desktop Management 2 - Internet Gateway installation

The following tables list and describe the parameters used for installing JP1/IT Desktop Management 2 - Internet Gateway from the provided media.

Changing the installation folder

Item

Description

Specifiable values

Default

Folder to which to install JP1/IT Desktop Management 2 - Internet Gateway

Specify the installation folder.

Path no longer than 104 bytes#

Folder specified for the %ProgramFiles(x86)% environment variable (if the OS is installed on the C drive, C:\Program Files(x86)\Hitachi\jp1itdmg\)

#: Available characters are single-byte alphanumeric characters, single-byte spaces, periods (.), parentheses, colons (:), underscores (_), and backslashes (\).

Important

Do not specify a folder in which other products (including JP1/IT Desktop Management 2) are installed as the installation folder.

(2) Setup parameters

The following tables list and describe the parameters for setting up a management server and agent.

Setup of a management server

Setup selection

Item

Description

Specifiable values

Default

Setup type

Select the setup type.

Reconfiguration

Database upgrade

Server reconfiguration

If the database does not need to be upgraded:

Reconfiguration

If the database needs to be upgraded:

Database upgrade

Database settings (for setting change)

Item

Description

Specifiable values

Default

Change the password for accessing the database

Specify whether to change the password for accessing the database.

Selected

The password is changed.

Not selected

The password is not changed.

Not selected

Current password

Specify the current password for the user ID.

A character string of 28 or fewer characters#

(Blank)

New password

Specify the new password for the user ID.

Confirm new password

Re-enter the specified new password for confirmation.

#: Available characters are single-byte alphanumeric characters. The first character must be an alphabetic character.

Selecting the server configuration

Item

Description

Specifiable values

Default

Server configuration#

Select the server configuration.

Single-server configuration

Multi-server configuration

Single-server configuration

#: You cannot change the setting from multi-server configuration to single-server configuration.

Cluster environment

Item

Description

Specifiable values

Default

Use JP1/IT Desktop Management 2 - Manager in a cluster configuration

Specify whether to use the management server in a cluster configuration.

Selected

Used in a cluster environment

Not selected

Not used in a cluster environment

Not selected

Type

Select the type.

Primary system

Standby system

Primary system

Logical host name

Specify a domain name.

A character string of 255 or fewer single-byte characters

(Blank)

Logical IP address

Specify an IP address.

An IPv4 IP address

(Blank)

Configuration file to be imported

Specify a configuration file to be imported.

A setup file name consisting of 255 or fewer characters (*.conf)

(Blank)

#: The management relay server in a multi-server configuration cannot be in a cluster configuration.

Database settings (for initial setting)

Password setting

Item

Description

Specifiable values

Default

User ID

Specify the user ID for accessing the database.

A character string of 8 or fewer characters#

itdm2m

Password

Specify the password for the user ID.

A character string of 28 or fewer characters#

(Blank)

Confirm password

Re-enter the specified password for confirmation.

#: Available characters are single-byte alphanumeric characters. The first character must be an alphabetic character.

Address and cache settings

Item

Description

Specifiable values

Default

IP address for accessing the database

Specify the IP address of the management server for accessing the database.

An IPv4 IP address

An IP address acquired by a Windows function#

Cache size when accessing the database

Select the cache size used when accessing the database.

1 GB

16 GB

16 GB

#: The first acquired IP address if multiple IP addresses are set for the management server (for example, when multiple network cards are used).

Folder settings

Item

Description

Specifiable values

Default

Database folder#1

Specify the folder in which database information is stored. For a cluster configuration, specify a folder on a shared disk.

A path consisting of 120 or fewer characters#2

All-User-profile-application-data-folder\Hitachi\jp1itdmm\Database\db\

Data folder#1

Specify the folder in which data used by the management server is stored. For a cluster configuration, specify a folder on the shared disk.

A path consisting of 120 or fewer characters#2

All-User-profile-application-data-folder\Hitachi\jp1itdmm\Database\data\

Local data folder#1

Specify a folder for the data area on a local disk. Note that a path to a shared disk cannot be specified.

A path consisting of 120 or fewer characters#2

All-User-profile-application-data-folder\Hitachi\jp1itdmm\LocalData\

Database extraction folder#1

Specify the folder in which a database is temporarily saved.

A path consisting of 120 or fewer characters#2

All-User-profile-application-data-folder\Hitachi\jp1itdmm\Database\dbtemp\

#1: The database folder, data folder, local data folder, and database extraction folder cannot be the same and cannot have a parent-child relationship with each other.

#2: Available characters are single-byte alphanumeric characters, single-byte spaces, hash marks (#), periods (.), parentheses, at marks (@), and backslashes (\).

Database upgrade settings

Item

Description

Specifiable values

Default

Type

Select the type.

Primary system

Standby system

Primary system

Configuration file to be imported

Specify the setup file copied from the primary node.

A setup file name consisting of 255 or fewer characters (*.conf)#2

(Blank)

Database folder#1

Specify the folder in which database information is stored. For a cluster configuration, specify a folder on the shared disk.

A path consisting of 120 or fewer characters#2

All-User-profile-application-data-folder\Hitachi\jp1itdmm\Database\db\

Database extraction folder#1

Specify the folder in which a database is temporarily saved.

A path consisting of 120 or fewer characters#2

All-User-profile-application-data-folder\Hitachi\jp1itdmm\Database\dbtemp\

#1: The database folder, data folder, local data folder, and database extraction folder cannot be the same and cannot have a parent-child relationship with each other.

#2: Available characters are single-byte alphanumeric characters, single-byte spaces, hash marks (#), periods (.), parentheses, at marks (@), and backslashes (\).

Operation log settings

Item

Description

Specifiable values

Default

Use Operation log

Specify whether to acquire operation logs from computers with agents installed.

Selected

Operation logs are acquired.

Not selected

Operation logs are not acquired.

For quick installation:

Not selected

For custom installation:

Not selected

Store the operation logs

Specify whether to store the operation logs.

Selected

Operation logs are stored.

Not selected

Operation logs are registered in the database, but not stored.

For quick installation:

Selected

For custom installation:

Selected

Operation log backup folder#1

Specify the folder in which the operation logs are stored.

A path consisting of 120 or fewer characters#2

(Blank)

Username#3

Specify the user name used for accessing the operation log backup folder.

A character string of 158 or fewer single-byte characters

(Blank)

Password

Specify the password for the user name.

A character string of 256 or fewer single-byte characters

(Blank)

Number of managed nodes

Specify the number of devices to be managed.

50 to 30000

For quick installation:

50

For custom installation:

200

Maximum number of days for which the operation logs are to be stored in the database

Specify the maximum number of days for which the operation logs are to be stored in the database. For example, specify100 for this item, if operation logs for 100 days are to be stored in the database.#4

30 to 500

60

Operation log database folder#5

Specify the database folder in which operation logs are stored.

A path consisting of 120 or fewer characters#6

All-User-profile-application-data-folder\Hitachi\jp1itdmm\Database\oplogdb

Capacity to be added to the cache

Specify the capacity, to be added to the database cache, for improving retrieval performance of operation logs.

0 to 16

0

#1: You can also specify a folder on a network drive. To specify a network drive, use UNC format.

#2: Available characters are single-byte alphanumeric characters, single-byte spaces, hash marks (#), periods (.), parentheses, at marks (@), backslashes (\), and hyphens (-).

#3: To specify a domain user, use domain-name\user-name format.

#4: The specified number of days cannot be decreased once it is specified.

#5: If the number of managed computers is in the range from 10,000 to 30,000, Hitachi recommends that you use a physical disk dedicated to the operation log database.

#6 : Available characters are single-byte alphanumeric characters, single-byte spaces, hash marks (#), periods (.), parentheses, at marks (@), and backslashes (\).

Revision history archive output settings

Item

Description

Specifiable values

Default

Regularly output and save the revision history archive

Specify whether to regularly output the revision history for archival purposes.

Selected

A revision history archive is regularly output.

Not selected

A revision history archive is not regularly output.

Not selected

Output folder for the revision history#1

Specify the folder in which the output revision history archive is stored.

A path consisting of 120 or fewer characters#2

(Blank)

User name#3

Specify the user name used for accessing the output folder.

A character string of 158 or fewer single-byte characters

(Blank)

Password

Specify the password for the user name.

A character string of 30 or fewer single-byte characters

(Blank)

#1: A folder on the network drive can also be specified. Use the UNC format to specify the network drive.

#2: Available characters are single-byte alphanumeric characters, single byte spaces, hash marks (#), periods (.), parentheses (()), at marks (@), backslashes (\), and hyphens (-).

#3: Use the domain-name\user-name format to specify a domain user.

API Settings

Item

Description

Specifiable values

Default

Use the API

Specify whether to use the API.

Selected

Using the API.

Not selected

Not using API.

Not selected

Port number settings

Item

Description

Specifiable values

Default

Port number for accepting connections from the administrator's computer

Specify the port number used to connect to the management server from the administrator's computer by using an operation window.

2 to 49151

31080

Port number for API connection

Specify the port number used to connect to the management server from an external system via the API.

2 to 49151

31030

Port number for accepting connections from agents

Specify the port number used to connect to the management server from agents.

5001 to 49151

31000

Port number for agent startup requests

Specify the port number used to connect to agents from the management server.

5001 to 49151

31001

Port numbers used by the server

Specify the start value of the 11 consecutive port numbers used for management server internal processing.

5001 to 49141

31002

Port number used by the API

Specify the start value of the four consecutive port numbers used by the API.

5001 to 49148

31026

Port number used for remote control

Specify the start value of the five consecutive port numbers used by the remote control function.

5001 to 49147

31016

Port number for multi-server configuration connections

Specify the port number used for relays between the management servers.

5001 to 49151

31023

Note: In a multi-server configuration, specify the same port number for both the higher management server and the lower management relay server.

Settings for address resolution

Item

Description

Specifiable values

Default

Specify the type of information that determines the connection-target computer for inter-host communication.

Host name

IP address

Host name

Address resolution method#1

Specify the addresses resolution method upon job creation or execution.

Use the Windows network

IP addresses are acquired from the Windows network upon job creation or execution.#2

Use device information and system configuration information

IP addresses are acquired only from the system configuration information of JP1/IT Desktop Management 2 upon job creation or execution.#3

Use the Windows network

When the address of the job destination cannot be resolved#1

Specify whether to treat a job for which address resolution for the destination failed during job execution as an error.

Treat as an error.

Do not treat as an error.

Do not treat as an error.

#1: Specify this item when Host name is selected as the type of information that determines the communication-target computer (which is called the ID key for operation).

#2: The hosts file or name server is used for address resolution. If address resolution fails, IP addresses are acquired from the system configuration information of JP1/IT Desktop Management 2.

#3: The IP addresses in the system configuration information of JP1/IT Desktop Management 2 must be always maintained in the correct state. In an environment in which jobs are created and executed while the name server is stopped (for example, during the night), even if you select Use the Windows network, address resolution might fail and jobs might not be created. However, if you select Use device information and system configuration information, you do not have to wait until address resolution fails.

Setting the management relay server

Item

Description

Specifiable values

Default

Higher connection destination

Specify the host name or the IP address of the higher management server to which the management relay server connects.#1

A character string of 64 or fewer characters#2

(Blank)

Send the operation log

Specify whether to send the operation log to the higher management server.

Selected

The operation log is sent to the higher management server.

Not selected

The operation log is not sent to the higher management server.

Not selected

Send USB-device registration information

Specify whether to send the USB-device registration information to the higher management server.

Selected

The USB-device registration information is sent to the higher management server.

Not selected

The USB-device registration information is not sent to the higher management server.

Not selected

#1: Specify in a format selected for the operation key specified in Settings for Address Resolution on the higher management server.

#2: In specifying, consider the following:

You can use alphanumeric characters and hyphens (-).

A period (.) can only be used as a separator.

If you specify an item with a host name, the first character must be alphabetic.

Communication settings of a management relay server

Item

Description

Specifiable values

Default

Interval for reporting to the higher-level server

Specify the interval for reporting to the higher management server.

1 to 60

5

Polling interval

Specify the polling interval between the management relay server and the higher management server.

1 to 720

120

Monitor no-communication periods

Specify whether a situation in which the response time from the higher management server exceeds the time specified in Monitoring period is regarded as a communication error.

Selected

Regarded as a communication error.

Not selected

Not regarded as a communication error.

Selected

Monitoring period

Specify the time for an agent installed on the management relay server to wait for a response from TCP/IP.

1 to 120

5

Retry if a communication error occurs

Specify whether to retry communication in the case that a communication error occurs.

Selected

Communication is retried.

Not selected

Communication is not retried.

Selected

Retry count

Specify the number of times the communication is retried.

1 to 999

5

Retry interval

Specify the interval between the retries.

1 to 7200

5

User management settings

Item

Description

Specifiable values

Default

Manage users by using JP1/Base

Specify whether to manage users by using JP1/Base.

Selected

Users are managed by using JP1/Base.

Not selected

Users are not managed by using JP1/Base.

Not selected

JP1 resource group name

When you choose to manage users by using JP1/Base, specify the name of the JP1 resource group to associate users with JP1/IT Desktop Management 2 - Manager.

A character string of 64 or fewer characters#

(Blank)

#: Available characters are single-byte alphanumeric characters and the following symbols:

exclamation mark (!), hash mark (#), dollar sign ($), percent sign (%), ampersand (&), single quotation mark ('), left parenthesis ((), right parenthesis ()), asterisk (*), hyphen (-), period (.), at mark (@), backslash (\), caret (^), underscore (_), grave accent mark (`), left curly bracket ({), right curly bracket (}), and swung dash (~)

Other settings

Item

Description

Specifiable values

Default

Currency unit setting

Specify the unit of money displayed in an operation window.

A character string of 10 or fewer single-byte characters

Currency unit set in the system

Control the network bandwidth on the management server

Specify whether to set the maximum transfer rate for sending packages from the management server to agents by using the ITDM-compatible distribution function.

Selected

The maximum transfer rate from the management server is set.

Not selected

The maximum transfer rate from the management server is not set.

Not selected

Maximum transfer rate

Specify the maximum transfer rate for sending packages.

2 to 1024

2

Number of consecutive login failures before the account is locked

Specify the number of consecutive login failures that are allowed before the account is locked.

0 to 10

0

Number of days until the password expires

Specify the expiration date of the password for the login user.

0 to 999

180

Suppress operations on asset information from the operation window

Specify whether to suppress operations on asset information from the operation window, for asset management from Asset Console.

Selected

Operations on asset information from the operation window are suppressed.

Not selected

Operations on asset information from the operation window are not suppressed.

Not selected

End of setup

Item

Description

Specifiable values

Default

Register components#1

Specify whether to register components such as agents and network monitor agents on the management server.

Selected

The programs are registered.

Not selected

The programs are not registered.

Selected

Automatic update of components#2

Specify whether to automatically distribute components, such as agents and network monitor agents, registered on the management server to computers if the components are updated.

Selected

Components are updated automatically.

Not selected

Components are not updated automatically.

Not selected

Register components as distribution packages#2

Specify whether to create component packages, which allow you to install updated components by using the distribution function.

Selected

Packages are created.

Not selected

Packages are not created.

Not selected

#1: Displayed when the first startup is started manually.

#2: Displayed when startup is started as an extension process of installation.

Setup for distribution by using Remote Install Manager

Communication

Item

Description

Specifiable values

Default

JP1/IT Desktop Management 2 - Manager (management server)

Specify the port number, of the management server, that is used for distribution using Remote Install Manager.

0 to 65535

31021

JP1/IT Desktop Management 2 - Agent (Relay System)

Specify the port number, of the relay system, that is used for distribution using Remote Install Manager.

0 to 65535

31002

Perform interval transmissions

Specify whether a file is divided by the specified unit and transmitted at the specified interval when a file transmission to agents and relay systems occurs.

Selected

Interval transmissions are performed.

Not selected

Interval transmissions are not performed.

Not selected

Number of continuous transmission buffers#

Specify the number of buffers that are used for one file transmission.

0 to 4294967295

1

Tranmission interval#

Specify the interval between transmissions (transmission suspension period) when interval transmissions are performed.

0 to 4294967295

1000

#: If 0 is specified, interval transmissions are not performed.

Server customization options

Item

Description

Specifiable values

Default

Number of JP1/IT Desktop Management 2 - Agent instances that can connect to the management server concurrently

Specify the maximum number of the following systems that can connect to the management server concurrently:

Agents

Relay systems

Remote Install Managers

Packagers

4 to 100

30

Number of JP1/IT Desktop Management 2 - Agent instances that can execute jobs concurrently#1

Specify the maximum number of the following systems that can execute jobs concurrently:

Agents

Relay systems

0 to 100

20

Specify when jobs will be deleted#2

Specify whether to delete jobs immediately after the job definitions and execution statuses are deleted.

If jobs are not deleted immediately, specify the time the jobs are to be deleted.

Selected

Jobs are not deleted immediately. If this option is selected, also specify the time the jobs are to be deleted.

00:00 to 23:59

Not selected

Jobs are deleted immediately.

Not selected

Monitor the startup of JP1/IT Desktop Management 2 - Agent

Specify whether to change the job execution status to startup failure and report it to the managing server if a job is not executed because an agent or relay system is not running.

Selected

Whether the agents and relay systems are running is monitored and reported to the managing server.

Not selected

Whether the agents and relay systems are running is not monitored.

Selected

Break down the reason for a starting failure

Specify whether to break down the reason for a starting failure and report it to the managing server when the startup of an agent or relay system fails.

Selected

The reason for a starting failure is broken down and reported to the managing server.

Not selected

The reason for a starting failure is not broken down.

Selected

Monitor file transfer errors of JP1/IT Desktop Management 2 - Agent

Specify whether to change the job execution status to communication error and report it to the managing server when a job of one of the following job types falls into a communication error during file transfer with an agent or relay system:

Install package

Send package, allow client users to choose

Transfer package to relay computer

Acquire collected files from relay computer

Get system configuration information

Get system information from computer (UNIX)#3

Hold report

Cancel holding of report

Selected

File transfer errors are monitored and reported to the managing server.

Not selected

File transfer errors are not monitored.

Not Selected

#1: If 0 is specified for this item, startup messages are not sent to the target system. In other words, if 0 is set, job execution from Remote Install Manager and startup of agents using agent control are no longer available.

#2: In general, because many agents are managed in distribution management, deleting job definitions and execution status requires long time for deleting the database. This might cause problems in operations, or place a load on main business operations. You can avoid this problem by delaying deletion of jobs and deleting such jobs at the same time when it is convenient.

#3: This job can also be executed on Mac agents.

Multicast distribution

Item

Description

Specifiable values

Default

Multicast distribution

Specify the port number that is used for multicast distribution of jobs.

0 to 65535

31014

Multicast distribution (when retransmission is required)#1

Specify the port number that is used for a request for resending of jobs by multicast distribution.

0 to 65535

31015

Allow jobs to be sent by multicast distribution#2

Specify this item to send jobs for which multicast distribution is specified, to agents and relay systems by multicast distribution.

Selected

Jobs are to be sent by multicast distribution.

Not selected

Jobs are not to be sent by multicast distribution.

Not selected

Multicast address

Specify the multicast address assigned to the distribution-destination multicast group#3.

224.0.1.0 to 239.255.255.255

238.255.0.1

Size of one packet

Specify the size of a packet used when a job is distributed.

1 to 60

40#4

#1: Because multicast distribution uses the UDP protocol, resending of packets occurs during distribution. Therefore, you must set the port number used for a request for resending.

#2: If you use a router that does not support IP multicast, do not select this option. If you do so, the distribution method is switched to unicast distribution, and it takes time until job distribution finishes.

#3: A multicast group must contain the agents that connect to the management server and the relay systems. If the multicast address for the distribution-destination agents and the relevant relay systems is different from the multicast address specified here, jobs are sent by unicast distribution to the agents and relay systems.

#4: The value of 40 KB is efficient enough for 100BASE communication lines. If the communication line is 10BASE, specify 4 KB. Note that, if the packet size is too large, multicast distribution might fail and change to unicast distribution from the middle of distribution.

Log options

Item

Description

Specifiable values

Default

Record the results of jobs#1

Specify whether to record the execution results of jobs for which no IDs are specified in Remote Install Manager.

Selected

The execution results of jobs for which no IDs are specified are recorded in Remote Install Manager.

Not selected

The execution results of jobs for which no IDs are specified are not recorded in Remote Install Manager.

Selected

Record result if the job is

Specify the execution status of the jobs to be recorded.

Error

Only the jobs whose execution status is Error are recorded in Remote Install Manager.

Error, Completed

The jobs whose execution status is Error or Completed are recorded in Remote Install Manager.

Error, Completed

Record the results of ID group jobs#2

Specify whether to record the execution results of jobs (for each client) for which IDs are specified.

Selected

The execution results of jobs (for each client) for which IDs are specified are recorded.

Not selected

The execution results of jobs (for each client) for which IDs are specified are not recorded.

Selected

Record result if the ID group job is

Specify the execution status of the jobs to be recorded.

Error, Finished

Jobs whose execution status is Error or Finished are recorded in Remote Install Manager.

Error, Finished, Completed

Jobs whose execution status is Error, Finished, or Completed are recorded in Remote Install Manager.

Error, Finished, Completed

Note: You can reduce the required disk capacity by recording necessary execution results only. If the large amount of execution results of finished jobs remain, Remote Install Manager might be slower. Therefore, Hitachi recommends that you record only the jobs whose execution status needs to be checked.

#1: The execution status of the following jobs cannot be automatically deleted even after the jobs finish:

Send package, allow client users to choose jobs

Get system information from computer (UNIX) jobs for which the execution date on agents has been specified

This job can also be executed on Mac agents.

Get software information from computer (UNIX) jobs for which the execution date on agents has been specified

This job can also be executed on Mac agents.

#2: For the execution results of an agent that belongs to the IDs managed by the relay system, this setting is enabled for all job types. For the execution results of an agent that belongs to the IDs managed by the managing server, this setting is disabled for the following jobs, and all execution statuses are recorded in the managing server:

Send package, allow client users to choose jobs

Get system information from computer (UNIX) jobs for which the execution date on agents has been specified

This job can also be executed on Mac agents.

Get software information from computer (UNIX) jobs for which the execution date on agents has been specified

This job can also be executed on Mac agents.

System configuration

Item

Description

Specifiable values

Default

Synchronize changes to the system configuration#

Specify whether to automatically apply the changes in the system configuration information of JP1/IT Desktop Management 2 to the system configuration information of the relay system.

Selected

The changes in the system configuration information are automatically applied to the system configuration information of the lower system.

Not selected

The changes in the system configuration information are not automatically applied to the system configuration information of the lower system.

Selected

Save deletion history

Specify whether to save the history of deleting a host from the system configuration information of JP1/IT Desktop Management 2.

Selected

The history of deleting a host from the system configuration information is saved.

Not selected

The history of deleting a host from the system configuration information is not saved.

Not selected

#: In a multi-server configuration, this item is always Selected.

Event service

Item

Description

Specifiable values

Default

Enable the event service

Specify whether to use the JP1/Base event service to report the execution results of jobs and errors in JP1/IT Desktop Management 2 as JP1 events to JP1/IM.

Selected

JP1 events are reported to JP1/IM.

Not selected

JP1 events are not reported to JP1/IM.

Not selected

Send job end event - At completion

Specify whether to report that all jobs for all destinations have normally finished.

Selected

That all jobs for all destinations have normally finished is reported.

Not selected

That all jobs for all destinations have normally finished is not reported.

Not selected

Send job end event - At error

Specify whether to report that an error occurred in a job.

Selected

That an error occurred in a job is reported.

Not selected

That an error occurred in a job is not reported.

Not selected

Send instruction end event - At completion

Specify whether to report that all instructions have normally finished.

Selected

That all instructions have normally finished is reported.

Not selected

That all instructions have normally finished is not reported.

Not selected

Send instruction end event - At error

Specify whether to report that an error occurred in an instruction.

Selected

That an error occurred in an instruction is reported.

Not selected

That an error occurred in an instruction is not reported.

Not selected

The types of jobs whose execution results can be reported to JP1/IM are shown below. For these jobs, the execution results of jobs can also be reported by more detailed unit (instruction). An instruction is the minimum unit of a job created by JP1/IT Desktop Management 2, and is created for each destination and for each distributed software program. For example, if a job is created that distributes two software programs to each of two destinations, four instructions are created for the job.

Install package

Transfer package to relay computer

Collect files from agent

Remote-collect files from agent to relay computer

Acquire collected files from relay computer

Send package, allow client users to choose

Error Handling

Item

Description

Specifiable values

Default

File names#

Generations of log file to be saved

Specify the maximum number of generations that are to be saved for each log.

1 to 999

10

Not applicable

MAIN file

Specify the number of lines on which MAIN log entries are output.

500 to 9,999

3000

MAIN.LOG

USER file

Specify the number of lines on which USER log entries are output.

500 to 9,999

3000

BUILD.LOG

SCRIPT.LOG

USER.LOG

COMPO file

Specify the number of lines on which COMPO log entries are output.

500 to 9,999

9999

API.LOG

ATRFILE.LOG

BSAPI.LOG

CLTPROTO.LOG

DEFAULT.LOG

EXCFILE.LOG

MNGFILE.LOG

RDBMENTE.LOG

SERVICE.LOG

SRVSOCK.LOG

STSFILE.LOG

WSH.LOG

FUNC file

Specify the number of lines on which FUNC log entries are output.

500 to 9,999

9999

AMTAPI.LOG

CLIENT.LOG

CLTDEL.LOG

DCMAMT.LOG

DISCVRY.LOG

DLL.LOG

INVENTRY.LOG

MLTPROTO.LOG

MONRST.LOG

MONTRACE.LOG

NDGMENT.LOG

PSM.LOG

SCHEDULE.LOG

SCHTRACE.LOG

SERVER.LOG

SITE.LOG

SRVAPI.LOG

SRVLOCK.LOG

USER_CLT.LOG

WRAPPER.LOG

LONG file

Specify the number of lines on which LONG log entries are output.

500 to 9,999

3000

DUMP.LOG

NODE.LOG

NODEOPR.LOG

RDBSRV.LOG

USERINV.LOG

Type of Event Viewer message

Specify the type of messages that are output to Windows NT's Event Viewer.

Error

Error messages are output.

Error, Warning

Error messages and warning messages are output.

Error, Warning, Information

Error messages, warning messages, and information messages are output.

Error

Not applicable

#: For log files that are not listed here, the number of log generations to be managed and the number of log entries cannot be set.

The capacity of each log file can be calculated by the following formula:

log-file-size (bytes) = (header-size + (size-of-an-entry x number-of-entries)) x (number-of-generations + 1)

header-size:

17 bytes

size-of-an-entry:

192 bytes (except LONG log entries) or 300 bytes (LONG entries)

A settings guide for error handling log information for each device configuration, and the disk usage capacity of the log files, are provided in the table below. Adjust the error handling log information settings to suit your operating environment.

Item

Device configuration

1,000 units

10,000 units

30,000 units

50,000 units

100,000 units

300,000 units

Error handling settings

Generations of log file to be saved

10

100

300

500

999

999

MAIN file

3000

3000

3000

3000

3000

9999

USER file

3000

3000

3000

3000

3000

9999

COMPO file

9999

9999

9999

9999

9999

9999

FUNC file

9999

9999

9999

9999

9999

9999

LONG file

3000

3000

3000

3000

3000

9999

Disk usage capacity (maximum)#

0.7GB

6.5GB

19.6GB

32.6GB

65.0GB

80.2GB

#: The disk usage capacity shown here is intended as a guide based on the assumption that all log files are created up to the number of generations set in the generations of log file to be saved setting.

If the number of generations of log file to be saved is reduced during operation, any log generation files that exceed the reduced number of generations of log file to be saved will not be used. Delete any superfluous log files as necessary.

Example: If the number of generations of log file to be saved is reduced from 100 to 10 during operation, log generation files 11 to 100 will not be used, even if they exist. The log generation files 11 to 100 can be deleted as necessary. The extension for log generation files is LOGn (with n being the generation number). In this example, delete files with the extension LOG11 to LOG100.

Audit Log

Item

Description

Specifiable values

Default

Units in which the audit log is to be output

Specify the unit in which the audit log is to be output.

Output for each job

Output for each command#

Output for each job

#: Note that, if Output for each command is selected, the capacity of the output audit log might greatly consumes free disk space.

Setup of a relay system

Connection-destination settings

Item

Description

Specifiable values

Default

Communicate with the higher system

Specify whether to connect to the management server.

Selected

Connected to the management server.

Not selected

Not connected to the management server.

Selected

Host name or IP address

Specify the host name or IP address of the management server to connect to.#1

Host name#2 or IPv4 IP address

Host name or IP address of the management server

Port number of management server

Specify the port number that is used when an agent connects to the management server.

5001 to 49151

31000

#1: If, in the settings for address resolution during management server setup, you specified a host name as the node identification key for operation, specify a host name here. If you specified an IP address, specify an IP address here.

#2: Specify the name using a character string of 255 or fewer characters.

Communication settings

Item

Description

Specifiable values

Default

Network Adapter Settings button

Click this button to set the priority among the communication lines used by JP1/IT Desktop Management 2 in an environment that has multiple network adapters (multiple LAN connections).

None

None

Network adapter settings

Item

Description

Specifiable values

Default

Specify the priority in which network adapters should be used

Specify whether to set the priority among network adapters for use when there are multiple network adapters.

Selected

The priority among network adapters is set.

Not selected

The priority among network adapters is not set.

Not selected

Automatically update network adapter information upon service startup or connection

Specify whether network adapter information is automatically updated upon service startup or connection.

Selected

Network adapter information is automatically updated.

Not selected

Network adapter information is not automatically updated.

Selected

Setup of an agent

Connection-destination settings

Item

Description

Specifiable values

Default

Communicate with the higher system

Specify whether to connect to the following higher systems:

Management server

Higher system for distribution

Selected

Connected to the higher systems.

Not selected

Not connected to the higher systems.

Selected

Host name or IP address

Specify the host name or IP address of the management server to connect to.#1

Host name#2 or IPv4 IP address

Host name or IP address of the management server

Port number of management server

Specify the port number that is used when an agent connects to the management server.

5001 to 49151

31000

Perform HTTPS communication with the higher system via the Internet Gateway

Specify whether an agent connects to a higher system via the Internet gateway.

Selected

An agent connects to a higher system via the Internet gateway.

Not selected

An agent does not connect to a higher system via the Internet gateway.

Not selected

Host Name or IP address

Specify the host name of the Internet gateway server or IP address.

Set a common name for the SSL server certificate. In the case of a wildcard certificate, specify the host name and the subdomain instead of the asterisk (*). When you set set an IP address as a common name, specify the IP address.

Host name#3 or IPv4 IP address

(Blank)

Port Number (Internet Connection Settings)

Specify the port number to be used when an agent connects to the Internet gateway server.

1 to 65535

443

#1: If, in the settings for address resolution during management server setup, you specified a host name as the node identification key for operation, specify a host name here. If you specified an IP address, specify an IP address here.

#2: Specify the name using a character string of 255 or fewer characters.

#3: Specify the name using a character string of 255 or fewer characters with single-byte alphanumeric characters and the following symbols:

hyphen (-) and period (.)

The beginning and the end of the character string must be single-byte alphanumeric characters.

Communication settings

Item

Description

Specifiable values

Default

Settings for network adapters button

Click this button to set the priority among the communication lines used by JP1/IT Desktop Management 2 in an environment that has multiple network adapters (multiple LAN connections).

None

None

Authenticate the User

Specify whether to authenticate the user with basic authentication provided by Microsoft Internet Information Services when an agent connects to the Internet gateway server.

Selected

The user is authenticated.

Not selected

The user is not authenticated.

Not selected

User ID (Authenticate the User)

Specify a user ID for user authentication.

A string that contains no more than 276 characters

(Blank)

Password (Authenticate the User)

Specify a password for user authentication.

A string that contains no more than 48 single-byte characters

Retype Password (Authenticate the User)

For confirmation, enter the specified password again.

Use the values set on the management server

Use the values set on the client

Select whether to use the value set on the management server or the one set on the client as the proxy server setting.

Use the values set on the management server

The value set on the management server is used as the proxy server setting.

Use the values set on the client

The value set on the client is used as the proxy server setting.

Use the values set on the management server

Use Proxy Server

Specify whether an agent communicates with the Internet gateway by using a proxy server.

Selected

An agent communicates with the Internet gateway by using a proxy server.

Not selected

An agent communicates with the Internet gateway without using a proxy server.

Not selected

Host name or IP Address (Use Proxy Server)

Specify the host name or IP address of the proxy server.

Host name# or IPv4-format IP address

(Blank)

Port Number (Use Proxy Server)

Specify the port number of the proxy server.

1 to 65535

User ID (Use Proxy Server)

Specify a user ID for the proxy server.

A string that contains no more than 276 characters

Password (Use Proxy Server)

Specify a password for the proxy server.

A string that contains no more than 48 single-byte characters

Retype Password (Use Proxy Server)

For confirmation, enter the specified password again.

#: Specify the name using a character string of 255 or fewer characters.

Network Adapter Settings

Item

Description

Specifiable values

Default

Specify the priority in which network adapters should be used#

Specify whether to set the priority among network adapters for use when there are multiple network adapters.

Selected

The priority among network adapters is set.

Not selected

The priority among network adapters is not set.

Not selected

Automatically update network adapter information upon service startup or connection

Specify whether network adapter information is automatically updated upon service startup or connection.

Selected

Network adapter information is automatically updated.

Not selected

Network adapter information is not automatically updated.

Selected

#: Do not select this item when you use the file for connection destinations (itdmhost.conf) for agents. This file is used when, for example, multiple management servers are provided for each range of assigned IP addresses for distributed management to prevent the number of devices managed by a management server from exceeding the limit. If this item is selected, the IP address used to determine the connection destination of an agent is collected from the network adapter having the highest priority. If IP addresses of managed devices are automatically assigned by the DHCP server, the connection destination might change each time the assigned IP address changes. Therefore, in the file for connection destinations, you need to specify the connection destination appropriate for the range of IP addresses that the DHCP server automatically assigns. For example, if the DHCP server assigns IP addresses in the range from 172.17.12.1 to 172.17.12.250, specify the connection destination for devices whose IP address is in the range from 172.17.12.1 to 172.17.12.250 in the file for connection destinations. You also need to ensure that you understand the IP addresses used by managed devices.

If you upgrade JP1/IT Desktop Management 2, the existing configuration items are displayed without changes, and the default values are displayed for new configuration items.

Setup of an Internet gateway

Connection-destination settings

Item

Description

Specifiable values

Default

Management server

Host name or IP address

Specify either the host name or the IP address of the management server to which the Internet gateway is connecting.

Host name#1 or IPv4-format IP address

(Blank)

Port number

Specify the port number to be used when the Internet gateway connects to the management server.

5001 to 49151

31000

Port number (multi-server configuration)#6

Specify the port number used for relays between the management servers over the Internet gateway.

5001 to 49151

31023

Higher system for distribution that uses Remote Install Manager

Management server

Relay system

Select a higher system used for distribution by using Remote Installation Manager.

Management server

Specify a management server as a higher system used for distribution by using Remote Installation Manager.

Relay system

Specify a relay system as a higher system used for distribution by using Remote Installation Manager.

Management server

Host name or IP address#5

Specify the host name or the IP address of the higher system used for distribution (management server or relay system).

Host name#2 or IPv4-format IP address

(Blank)

Port number (management server)#3

Specify the port number to be used when the Internet gateway connects to the management server.

1 to 65535

31021

Port number (relay system)#4

Specify the port number to be used when the Internet gateway connects to the relay system.

1 to 65535

31002

#1: Specify the name using a character string of 255 or fewer characters. When you use Remote Install Manager for distribution and the host name of the management server exceeds 64 characters, specify the IP address.

#2: Specify the name using a character string of 64 or fewer single-byte characters.

#3: You can edit this item only when you have selected Management server.

#4: You can edit this item only when you have selected Relay system.

#5:

Using Remote Install Manager for distribution

Install a relay system to the Internet gateway server, and specify Relay system to Higher system for distribution that uses Remote Install Manager and localhost to Host name or IP address.

Not using Remote Install Manager for distribution

Specify Management server to Higher system for distribution that uses Remote Install Manager and the host name or the IP address of the management server to Host name or IP address.

#6: In higher management server setup to which the Internet gateway connects, specify the port number specified in Port number for multi-server configuration connections in Settings module.

(3) User account parameters

The following table lists and describes the parameters in the Account Management view that opens from User Management in the Settings module.

Users:

Item

Description

Specifiable values

Default

User Account

Set the user account for JP1/IT Desktop Management 2.

User account

System

User ID

Specify the user ID used to log in to an operation window.

A character string of 64 or fewer single-byte characters#1

(Blank)

Password

Specify the password for the user ID.

A character string of 32 or fewer single-byte characters#2

(Blank)

Retype Password

Enter the password again.

A character string of 32 or fewer single-byte characters#2

(Blank)

User Name

Specify the user account name.

A character string of 128 or fewer characters

(Blank)

E-mail

Specify the email address of the user account user.

Email character string

(Blank)

Description

Enter a description of the user account.

A character string of 1,024 or fewer characters

(Blank)

System Administrator#3

Specify whether to assign system administrator permission to the user account.

Selected

System administrator permission is assigned.

Not selected

System administrator permission is not assigned.

Not selected

User Management#3

Specify whether to assign user account management permission to the user account.

Selected

User account management permission is assigned.

Not selected

User account management permission is not assigned.

Not selected

Security management

Specify whether to set security management as a task for the user account.

Selected

Security management is set as a task for the user account.

Not selected

Security management is not set as a task for the user account.

Selected

Asset management

Specify whether to set asset management as a task for the user account.

Selected

Asset management is set as a task for the user account.

Not selected

Asset management is not set as a task for the user account.

Selected

Device management

Specify whether to set device management as a task for the user account.

Selected

Device management is set as a task for the user account.

Not selected

Device management is not set as a task for the user account.

Selected

Distribution management

Specify whether to set distribution management as a task for the user account.

Selected

Distribution management is set as a task for the user account.

Not selected

Distribution management is not set as a task for the user account.

Selected

System configuration management

Specify whether to set system configuration management as a task for the user account.

Selected

System configuration management is set as a task for the user account.

Not selected

System configuration management is not set as a task for the user account.

Not selected

Set the administration scope for this user account

Specify whether to set an administration scope for the user account.

Selected

An administration scope is set for the user account.

Not selected

No administration scope is set for the user account.

Not selected

Administration scope

Specify the administration scope.

Groups in the department

Not set.

Status

Displayed only when the user account has been locked. If Disabled has been selected, you cannot log in to JP1/IT Desktop Management 2.

Enabled

You can unlock the user account.

Disabled

The user account has been locked.

Disabled

#1

Available characters are single-byte alphanumeric characters and the following symbols:

Exclamation marks (!), double quotation marks ("), hash marks (#), dollar signs ($), percent signs (%), ampersands (&), single quotation marks ('), parentheses, asterisks (*), plus signs (+), commas (,), hyphens (-), periods (.), forward slashes (/), colons (:), semicolons (;), less-than signs (<), equal signs (=), more-than signs (>), question marks (?), at marks (@), square brackets, backslashes (\), carets (^), underscores (_), grave accent marks (`), curly brackets, vertical bars (|), swung dashes (~), and single-byte spaces

#2

Observe the following rules when setting a password for the user account.

Use 8 to 32 characters.

Use single-byte alphanumeric characters and the following symbols:

Exclamation marks (!), double quotation marks ("), hash marks (#), dollar signs ($), percent signs (%), ampersands (&), single quotation marks ('), parentheses, asterisks (*), plus signs (+), commas(,), hyphens (-), periods (.), forward slashes (/), colons (:), semicolons (;), less-than signs (<), equal signs (=), more-than signs (>), question marks (?), at marks (@), square brackets, backslashes (\), carets (^), underscores (_), grave accent marks (`), curly brackets, vertical bars (|), swung dashes (~), and single-byte spaces

Use a combination of two or more types of characters.

Use a character string that is different from the user ID.

When changing the password, use a different character string from the current one.

#3

If neither System Administrator nor User Management is selected, view permission is assigned to the user account.

Email Notification Destinations:

Item

Description

Specifiable values

Default

Email Notification Destinations:

Specify the email notification destination that is used by the email notification function.

Email notification destination

(Blank)

User Name

Specify the name of the email notification destination.

A character string of 128 or fewer characters

(Blank)

E-mail

Specify the email address of the email notification destination.

Email character string

(Blank)

Description

Specify a description of the email notification destination.

A character string of 1,024 or fewer characters

(Blank)

(4) Agent parameters

The following tables list and describe the parameters in the Add Agent Configuration and Edit Agent Configuration dialog boxes that open from the Windows Agent Configurations and Create Agent Installers view in the Settings module.

Furthermore, if you are operating on a management server for which the large-scale management option was enabled, the default values for some items may vary. For details about the differences in default values, see 2.25.1 Differences due to the large-scale management option.

Basic settings

Item

Description

Specifiable values

Default

Management server

Host name or IP address

Specify the host name or IP address of the management server that the agent connects to.

Host name#1 or IPv4 address

Host name or IP address of the management server

Port number

Specify the port number that the agent uses to connect to the management server.

5001 to 49151

Port number specified for Port number for Agent connection in the Port Number Settings dialog box during management server setup

Higher-level system for distribution that uses Remote Install Manager#2

System type

Specify the higher-level system for distribution using Remote Install Manager. In the following cases, make sure to specify Management server:

When you create an agent configuration that is to be assigned to the relay system.

When you edit the default agent configuration.

Management server

Relay system

Management server

Host name or IP address

Specify the host name or IP address of the higher-level system for distribution using Remote Install Manager. In the following cases, make sure to specify the host name or IP address of the management server:

When you create an agent configuration that is to be assigned to the relay system.

When you edit the default agent configuration.

Host name#3 or IPv4 address

Host name or IP address of the management server

Port number for distribution (for the management server)

Specify the port number that is used when the agent connects to the management server for distribution.

1 to 65535

Port number specified for IT Desktop Management 2 - Manager (management server) of Port numbers under Related to Communications in the Setup for Distribution by Using Remote Install Manager dialog box during management server setup

Port number for distribution (for the relay system)

Specify the port number that is used when the agent connects to the relay system for distribution.

1 to 65535

Port number specified for IT Desktop Management 2 - Manager (Relay System) of Port numbers under Related to Communications in the Setup for Distribution by Using Remote Install Manager dialog box during management server setup

Internet Connection Settings

Perform HTTPS communication with the higher system via the Internet Gateway

Specify whether an agent connects to a higher system via the Internet gateway.

Selected

An agent connects to a higher system via the Internet gateway.

Not selected

An agent does not connect to a higher system via the Internet gateway.

Not selected

Internet Gateway

Host Name or IP address

Specify the host name or IP address of the Internet gateway server.

Set a common name for the SSL server certificate. In the case of a wildcard certificate, specify the host name and the subdomain instead of the asterisk (*). When you set set an IP address as a common name, specify the IP address.

Host name#12 or IPv4 IP address

(Blank)

Internet Gateway

Port Number

Specify the port number to be used when an agent connects to the Internet gateway server.

1 to 65535

443

Port Number to Be Used by the Agent

Specify the port number to be used within an agent when the agent connects to the Internet gateway server.

1 to 65534

31024

Communicate directly with the higher system if the Internet Gateway is unavailable

Specify whether an agent communicate directly with the higher system if the Internet Gateway is unavailable.

Selected

An agent communicate directly with the higher system if the Internet Gateway is unavailable.

Not selected

An agent does not communicate directly with the higher system if the Internet Gateway is unavailable.

Not selected

Communicate with the higher-level system

Specify whether the agent communicates with the higher-level system.

Selected

The agent communicates with the higher-level system. Select the check box to manage computers online.

Not selected

The agent does not communicate with the higher-level system. Clear the check box to manage computers offline.

Selected

Periodically notify the higher system of the information collected from the computer

Specify whether to periodically notify the higher system of the information collected from the computer.

Selected

Information is periodically sent to the higher system.

Not selected

Information is not sent to the higher system.

Selected

Monitoring interval - Security items (minutes)

Specify the monitoring interval for updates of device information related to agent security.#4

1 to 9999

10

Monitoring interval - Other information (minutes)

Specify the monitoring interval for updates of device information other than agent security.#4

1 to 9999

60

Flow Control

Specify whether to use flow control to limit how much data the ITDM-compatible distribution function can transfer per hour when transferring packages to agents from the management server.

Use this parameter for compatibility with the JP1/IT Desktop Management settings. If you do not need compatibility with JP1/IT Desktop Management, select OFF.

ON

Flow control is used. Specify, in the range from 30 to 99 (99 by default), the maximum percentage of network bandwidth the distribution function can use per hour.

OFF

Flow control is not used.

OFF

Perform polling based on the system startup#5

Specify whether to perform polling based on the system startup.

Selected

Polling is performed based on the system startup.

Not selected

Polling is not performed based on the system startup.

Selected

Polling timing

Select, from the drop-down list whether to perform polling before or after the downloaded package installation process at system startup.#6

Before the client starts

When the agent starts, polling is performed, and then downloaded packages are installed.#7

After the client starts

When the agent starts, downloaded packages are installed, and then polling is performed.#8

Before the client starts

Polling method

Specify the polling method.

Perform polling one time (only when the system starts)

Polling is performed only once when the system starts. You can select Perform polling on every system startup or Perform polling only during the first system startup (once a day) from the drop-down list only when you select Before the client starts for Polling timing.

Periodically perform polling on every system startup

Polling is performed at a specified interval. Specify the interval in the range from 1 to 720 minutes.

Periodically perform polling on every system startup (30 minutes)

Polling start time

Specify the time to wait before polling is started after the system starts, and the timing of startup of polling.

Start polling during system startup

Polling is started at the same time the system starts.

Start polling at the specified timing

Polling is started at an arbitrary timing after the agent starts, until the specified time (seconds) has passed. Specify the time, in the range from 1 to 300 seconds (1 second by default), until which polling is to be started.#9

Start polling at the specified timing

Polling is started after the specified time period (seconds) has passed after the agent starts. Specify the time in the range from 1 to 7200 seconds (1 second by default).

Start polling during system startup

Perform polling at the specified time

Specify whether to perform polling once a day at the specified time.

Selected

Polling is performed at the specified time.

Not selected

Polling is not performed at the specified time.

Not selected

Execution time

Specify the time polling is to be executed.

00:00 to 23:59

00:00

Detection of change in JP1/IT Desktop Management 2 - Agent

Specify whether to display an event indicating that the contents of the JP1/IT Desktop Management 2 - Agent installation folder have been changed.

Clear this check box only when you need to reduce the memory usage on the managed computer. If you clear this check box, the amount of used virtual memory is reduced by approximately 8 MB.

Note that if you clear this check box, Location under the JP1/IT Desktop Management 2 - Agent installation folder will not be monitored. Therefore, even if the components are configured to be automatically updated, automatic re-installation (recovery) of an agent does not work, thus lowering the security level.

Selected

An event is displayed.

Not selected

An event is not displayed.

Selected

Internet Gateway Communication Settings

Authenticate the User

Specify whether to authenticate the user with basic authentication provided by Microsoft Internet Information Services when an agent connects to the Internet gateway server.

Selected

The user is authenticated.

Not selected

The user is not authenticated.

Not selected

Authenticate the User

User ID

Specify a user ID for user authentication.

A string that contains no more than 276 characters

(Blank)

Authenticate the User

Password

Specify a password for user authentication.

A string that contains no more than 48 single-byte characters

Authenticate the User

Retype Password

For confirmation, enter the specified password again.

Use Proxy Server

Specify whether an agent communicates with the Internet gateway by using a proxy server.

Selected

An agent communicates with the Internet gateway by using a proxy server.

Not selected

An agent communicates with the Internet gateway without using a proxy server.

Not selected

Use Proxy Server

Host name or IP Address

Specify the Host name or IP address of the proxy server.

Host name#13 or IPv4-format IP address

(Blank)

Use Proxy Server

Port Number

Specify the port number of the proxy server.

1 to 65535

Use Proxy Server

User ID

Specify a user ID for the proxy server.

A string that contains no more than 276 characters

Use Proxy Server

Password

Specify a password for the proxy server.

A string that contains no more than 48 single-byte characters

Use Proxy Server

Retype Password

For confirmation, enter the specified password again.

Issue an error if an attempt to connect to the Internet Gateway is made after the server certificate expires

Specify whether communication with the Internet gateway should end in failure when the server certificate expires.

Selected

Communication with the Internet gateway ends in failure when the server certificate expires.

Not selected

Even when the server certificate expires, communication with the Internet gateway does not end in failure.

Not selected

Size of Files into Which Uploaded Files Are to Be Split

Set the split size of the file to be sent in kilobytes. Change this value when the proxy server, Microsoft Internet Information Services or other destination server has space limitations.#14

10 to 102400

1024

Customize Installation Options#10

Specify the path into which the agent is to be installed.

A character string of 64 or fewer characters#11

%ProgramFiles%\Hitachi\jp1itdma

#1: Specify the host name using a character string of 255 or fewer characters.

#2: The value set for this item is always the same as the value for the higher-level system that is displayed in Higher-level system to be polled of Communication settings as the first-priority higher-level system.

#3: Specify the host name using a character sting of 64 or fewer characters. Available characters are single-byte alphanumeric characters, periods (.), and hyphens (-).

#4: For the Citrix XenApp and Microsoft RDS server, specify "1440" so that the monitoring interval becomes once a day. If you specify a value lower than "1440", the functions might be affected because the load becomes heavy in operation.

#5: If you execute a job after setting the timing of software execution to Execute the next time the system starts, select the Perform polling based on the system startup check box.

#6: If the agent is not started during job execution, you can use this setting to control the timing for installing packages for which Install when system starts is set.

#7: If a package with Install when system starts specified has already been registered in the managing server, the package is installed immediately after it is downloaded due to the polling upon system startup. Therefore, installation is completed during one system startup. If the ITDM2_Startup folder has been created, the programs registered in the ITDM2_Startup folder are started after the packages with Install when system starts specified are installed. If you want the startup of the programs registered in the ITDM2_Startup folder to be performed earlier, specify After the client starts.

#8: The packages that have already been downloaded are installed when the system starts, but the packages that are downloaded later due to polling and with Install when system starts specified are installed next time the system starts.

#9: When this setting has been specified, even if multiple agents start at the same time, they do not try to connect to the higher system at the same time, which can distribute the load on the network. Setting a larger value for this item can reduce the load when the system performance is not sufficient for the number of agents connected to the higher system, or when too much load is placed on the network.

#10: This item is displayed only when the default agent is set.

#11: Available characters are single-byte alphanumeric characters, single-byte spaces, percent signs (%), periods (.), parentheses, backslashes (\), and underscores (_).

#12: Specify the name using a character string of 255 or fewer characters with single-byte alphanumeric characters and the following symbols:

hyphen (-) and period (.)

The beginning and the end of the character string must be single-byte alphanumeric characters.

#13: Specify the name using a character string of 249 or fewer characters with single-byte alphanumeric characters and the following symbols:

hyphen (-) and period (.)

The beginning and the end of the character string must be single-byte alphanumeric characters.

#14: If Request Filtering, which is a role service provided by Microsoft Internet Information Services, is installed, the upload file size is restricted to 30,000,000 bytes by default. Request Filtering is installed by default when Microsoft Internet Information Services is installed.

Password settings

Item

Description

Specifiable values

Default

Settings to protect agents

Setting Password Protection will prevent end users from modifying agent configuration and uninstallation

Specify whether to set a password to prevent users from changing the agent setup settings or performing uninstallation.

Selected

A password is requested upon agent setup and uninstallation.

Not selected

No password is requested upon agent setup and uninstallation.

Selected

Password

Specify the password that will be requested upon agent setup or uninstallation.

A character string of 1 to 128 ASCII characters

(Blank)

Confirm password

Re-enter the specified password for confirmation.

Settings to protect information from external storage media.#

Use a password to protect information sent using external storage media.

Specify whether to set a password to protect information in external storage media from users.

Selected

A password is requested to retrieve information from external storage media.

Not selected

No password is requested to retrieve information from external storage media.

Not selected

Password

Specify the password that will be requested when information in external storage media is retrieved.

A string of 1 to 128 ASCII characters

(Blank)

Confirm password

Re-enter the specified password for confirmation.

Protection settings for registering USB devices

Protect USB Device Registration with Password

Specify whether to set a password to prevent the user from registering a USB device.

Selected

A password is requested to register a USB device.

Not selected

No password is requested to register a USB device.

Not selected

Password

Specify the password that will be requested to register the USB device.

A string of 1 to 128 ASCII characters

(Blank)

Confirm password

Re-enter the specified password for confirmation.

#: If the version is upgraded from JP1/IT Desktop Management earlier than 10-01 to JP1/IT Desktop Management 2, the password specified for Settings to protect agents is automatically set.

Relay system settings

Item

Description

Specifiable values

Default

Settings of the system where IDs will be registered

Management server

Host name or IP address

As the host name or IP address of the higher system where IDs will be registered, the host name or IP address specified for Management server of Basic settings is displayed.

None

None

System where IDs will be registered

System type

Select the type of system where IDs will be registered.

Management server

Relay system

Relay system

Host name or IP address

Specify the host name or IP address of the system selected by System type of System where IDs will be registered.#1

If you selected Relay system for System type of System where IDs will be registered when creating an agent configuration to be assigned to the relay system, Hitachi recommend that you specify localhost.

Host name#2 or IPv4 address

localhost

Specify ID Key for Operations

Select the ID key for operations (information for identifying a computer) that is used for distribution using Remote Install Manager.

Host name

When you create or execute a job, select Use the Windows network or Use the system configuration information of IT Desktop Management 2 from the drop-down list as the address resolution method. (The default is Use the Windows network.)

IP address

Host name or IP address that was specified in the Settings for Address Resolution dialog box during management server setup

Settings to send notifications to JP1/IT Desktop Management 2 - Manager

Transmission timing for processing result files

Specify the timing of sending notification files received from lower systems to the managing server.

Immediately

Periodically

Immediately

Receive jobs and transmit result file processing in parallel

Specify whether the relay system will execute reception of jobs (download) and transmission of notification files (upload) in parallel during communication with the connected higher system (management server).

Selected

Reception of jobs and transmission of processing result files are performed in parallel.

Not selected

Reception of jobs and transmission of processing result files are not performed in parallel.

Selected

Notify JP1/IT Desktop Management 2 - Manager of the status of the split distribution executed on the lower JP1/IT Desktop Management 2 - Agent

Specify whether to notify the higher system of the state of progress of the split distribution (of packages) being executed on the lower system.

Selected

Notification of the state of progress of the split distribution is sent to the higher system.

Not selected

Notification of the state of progress of the split distribution is not sent to the higher system.

Not selected

Processing settings for the relay system

Number of JP1/IT Desktop Management 2 - Agents that can be connected to the relay system concurrently

Specify the number of agents that can be connected to the relay system concurrently.

4 to 1000#3

50

Number of job download requests for JP1/IT Desktop Management 2 - Agents

Specify the number of agents to be executed concurrently#4 when a job is executed.

Specify the number of job download requests to be executed concurrently

Specify the number of jobs to be executed concurrently in the range from 1 to 9999.

Do not execute job download requests

Because the startup message is not sent to agents, startup of agents using job execution or client control is not available.

Specify the number of job download requests to be executed concurrently (20)

Job management file cache

Specify the upper limit of the cache size#5 on the relay system's memory for the executed job information (management files).

Specify the upper limit of the cache size

Specify the upper limit of the cache size on the memory in the range from 1 to 1,000,000 KB.

Do not cache

Executed job information (management files) is not cached.

Specify the upper limit of the cache size (100,000 KB)

Monitor the startup of JP1/IT Desktop Management 2 - Agent when a job is executed

Specify whether to change the job execution status to Startup failure and report it to the managing server when a job is not executed because the agent is not running.

Selected

The execution status of ID jobs that normally finished on the agent is reported to the relay system.

Not selected

The execution status of ID jobs that normally finished on the agent is not reported to the relay system.

Selected

Subdivide the cause of startup failures

Specify whether to subdivide the cause of agent's startup failures and report it to the managing server.

Selected

The cause of startup failures is subdivided.

Not selected

The cause of startup failures is not subdivided.

Selected

Note: The Citrix XenApp and Microsoft RDS server does not support relay systems.

#1: If, during the setup for the management server, you specified a host name as the ID key for operations specified in Settings for Address Resolution, specify a host name here. If you specified an IP address, specify an IP address here.

#2: Specify the host name using a character string of 64 or fewer single-byte characters.

#3: The value specified in Number of JP1/IT Desktop Management 2 - Agents that can Be Connected to the Relay System Concurrently can exceed the upper limit when JP1/IT Desktop Management version is 10-10 or earlier, or at a time immediately after JP1/IT Desktop Management 2 is upgraded from version 10-50. In this case, a dialog will appear to prompt you to change the upper limit when you click the Edit button in the relevant agent configurations in the Agent - Windows Agent Configurations and Create Agent Installers view under the Settings module.

#4: Specifically, this number is the number of startup messages that the managing server sends to agents at one time. If the number of agents on which jobs are executed is larger than the specified value, the jobs are divided and executed based on this specified value. If 0 is specified, startup messages are not sent to the lower system, so that execution of jobs initiated by the higher system and startup of the destination using client control will not be available. Note that you must specify the size of a file to be distributed, considering the network performance. If the size is too large (10 MB or more), the network load might increase even with a few agent connections.

#5: If the total size of management files exceeds its upper limit, the throughput of job processing will decrease. Hitachi recommends that you specify an appropriate value for the upper limit of cache size of management files based on the scale of your operation environment, in order to prevent any decrease in throughput of job processing. Use the formula below to calculate the guideline value to be specified, by entering the estimated values for individual elements. If the cache size exceeds its upper limit due to an increase in the number of management files, delete the management file that is least referenced, and then cache a new management file. If Do not cache is selected, the job management files on a disk are accessed every time agents request polling, so replying to the agents might be delayed.

Cache size for management files (KB) = number of executed jobs stored in the relay system x number of destinations for each job x number of packages for each job (for remote installation jobs) x 1 KB

User notification settings

Item

Description

Specifiable values

Default

Settings to shut down and restart the computer#1

For user computers, display a dialog box that instructs the user to shut down or restart the computer

Specify whether the user's computer accepts the administrator's instructions for shutdown and restart of the computer.#2

Selected

The user's computer accepts the administrator's instructions for shutdown and restart of the computer.

Not selected

The user's computer does not accept the administrator's instructions for shutdown and restart of the computer.

Selected

Computer shutdown or restart timing

Specify the timing the user's computer starts shutting down or restarting when an update program or a program that requires restarting is distributed.

Automatically start if no response is received from the user within the specified period

Shutdown or restart is automatically started. Specify the time to wait until the automatic startup begins in the range from 1 to 1440 minutes.#3

Follow the response of the user in the dialog box that instructs the user to shut down or restart the computer

Neither shutdown nor restart is started until the user responds.

Automatically start if no response is received from the user within the specified period (3 minutes)

Display Settings on User Computers

When an action item user is notified of a message

Specify whether to display a balloon tip on the user's computer when the user receives a message that is set as the security determination result in Action Items for a security policy.#4

Displayed (balloon tip)

A balloon tip is displayed on the user's computer.

Hidden

A balloon tip is not displayed on the user's computer.

Displayed (balloon tip)

When users are instructed to restart the computer

Specify whether to display a balloon tip on the user's computer when restart of the computer is required due to application of security policies or software.#4

Displayed (balloon tip)

A balloon tip is displayed on the user's computer.

Hidden

A balloon tip is not displayed on the user's computer.

Displayed (balloon tip)

When a user input window is displayed

Specify whether to display, on the user's computer, the message indicating that the system administrator requests input of user information.#4

Displayed (user input screen)

The window for entering user information is displayed on the user's computer.

Displayed (balloon tip)

A balloon tip is displayed on the user's computer.

Hidden

Neither the window for entering user information nor a balloon tip is displayed on the user's computer.

Displayed (balloon tip)

When distributing packages (ITDM-compatible distribution)

Select whether to display a balloon tip on the user's computer when software distribution is performed.#4

Displayed (balloon tip)

A balloon tip is displayed on the user's computer.

Hidden

A balloon tip is not displayed on the user's computer.

Displayed (balloon tip)

Display settings for notification dialog boxes

Display when a job fails

Specify whether the notification dialog box is displayed on the user's computer when a job fails.#5

Selected

The notification dialog box is displayed on the user's computer.

Not selected

The notification dialog box is not displayed on the user's computer.

Not selected

If a shortcut file that failed to start from ITDM2_Startup exists, display a message asking whether to delete the shortcut file

Specify whether to display a confirmation dialog box for deletion of icons and shortcut files that have been registered in the ITDM2_Startup folder and cannot be executed.#6, #7

Selected

A confirmation dialog box is displayed for deletion of icons and shortcut files that cannot be executed.

Not selected

The confirmation dialog box is not displayed for deletion of icons and shortcut files that cannot be executed.

Not selected

#1: This setting is ignored if the computer is the relay system.

#2: Because the Citrix XenApp and Microsoft RDS server does not support the display of a dialog box that instructs the user to shut down or restart the computer, clear this check box.

#3: A confirmation dialog box is displayed on the user's computer until the time specified here passes.

#4: Because the Citrix XenApp and Microsoft RDS server does not support the display of a balloon tip, select Hidden.

#5: For the Citrix XenApp and Microsoft RDS servers, specify "Not selected" because displaying of a notification dialog is not supported when an execution of a job fails.

#6: You might not be able to execute a program because the execution file of the program registered in the ITDM2_Startup folder has already been uninstalled. In such a case, you can set to display a confirmation dialog box asking whether to delete icons and shortcut files that cannot be executed.

#7: Because the Citrix XenApp and Microsoft RDS server does not support the display of a dialog box that asks for confirmation to delete the icons and shortcut files that cannot be executed, clear this check box.

Job settings

Item

Description

Specifiable values

Default

Display settings for dialog boxes indicating that a job is being processed

Display a dialog box indicating that processing is in progress

Specify whether to display a dialog box indicating that download or installation is being processed on the agent.#1

Selected

A dialog box indicating that download or installation is being processed is displayed.

Not selected

A dialog box indicating that download or installation is being processed is not displayed.

Selected

Display a dialog box indicating that a package is being downloaded

Specify whether to display a dialog box indicating that a package is being downloaded.

Selected

A dialog box indicating that a package is being downloaded is displayed.

Not selected

A dialog box indicating that a package is being downloaded is not displayed.

Selected

Displayed dialog box

Specify the type of dialog box indicating that download processing is in progress.

Default dialog box

The dialog box provided by JP1/IT Desktop Management 2 by default is displayed.

Dialog box specified by the program

The specified program created by a user for displaying a dialog box is started and the corresponding dialog box is displayed.

Default dialog box

Display a dialog box indicating that a package is being installed

Specify whether to display a dialog box indicating that a package is being installed.

Selected

A dialog box indicating that a package is being installed is displayed.

Not selected

A dialog box indicating that a package is being installed is not displayed.

Selected

Displayed dialog box

Specify the type of dialog box indicating that installation processing is in progress.

Default dialog box

The dialog box provided by JP1/IT Desktop Management 2 by default is displayed.

Dialog box specified by the program

The specified program created by a user for displaying a dialog box is started and the corresponding dialog box is displayed.

Default dialog box

Display the dialog box in the forefront

Specify whether to display the dialog box in the foreground, to indicate that installation processing is in progress.

Selected

The dialog box indicating that installation processing is in progress is displayed in the foreground.

Not selected

The dialog box indicating that installation processing is in progress is not displayed in the foreground.

Not selected

Program to display dialog boxes

Specify the name of a program to display dialog boxes when Dialog box specified by the program is selected as the type of dialog boxes to be displayed.

The path to a program (a program file whose extension is exe) created by a user for displaying dialog boxes.#2

(Blank)

Settings to perform a retry when a remote installation or remote collection fails

Perform a retry

Specify whether to perform a retry when an error occurs while remote installation or remote collection of user programs or data is in progress.

Selected

A retry is performed.

Not selected

No retry is performed.

Selected

Retry count

Specify the retry count that is allowed.

1 to 100

10

Retry interval

Specify the retry interval.

Periodically perform retries

Specify the interval in the range from 1 to 3600 (seconds).

Immediately perform retries

The specified number of retries are performed without interval.

Periodically perform retries (1 second)

Settings for split distribution of packages

Split packages to be distributed#3

Specify whether to split and distribute a package if it is larger than the size specified here.

Selected

A package is split into the size specified here and distributed.

Not selected

A package is distributed without being split.

Selected

Split size

Specify the size a package is to be split.

This split size is applied to each package to be distributed.

When specified in KB:

1 to 2097151

When specified in MB:

1 to 2047

2097151KB

Transmission suspension period

Specify the interval (suspension period) between split distributions of a package.

1 to 1440

60

Installation waiting time settings

Time to wait for a response from the installer

Specify the maximum time to wait for the response from the installer during remote installation of a Hitachi program product.

If no response is received when the specified time expires, an error is reported to the higher system.

180 to 7200

1800

Settings to permit job holds#4

Permit users to hold jobs

Specify whether to have the user select whether to execute a job transmitted from the higher system.#5

Selected

The user selects whether to execute the job.#6

Not selected

The user does not select whether to execute the job.

Not selected

Timing to release job holds

Specify the timing to release temporary job holds when whether to execute jobs is selected by the user.

Automatically release job holds if no user response is received within the specified period

Specify the time (in the range from 1 to 1800 seconds) to wait until job holds are released.#7

Do not release job holds until a user response is received

Execution of jobs is held until the response from the user is received.#8

Automatically release job holds if no user response is received within the specified period (180 seconds)

Settings to suppress notifications

Suppress notifications on jobs waiting to be installed and collected

Specify whether to suppress notifications on jobs waiting to be installed or collected, to the higher system.#9

Selected

Notifications to the higher system are suppressed.

Not selected

Notifications to the higher system are not suppressed.

Not selected

Interval transmission settings

Perform interval transmissions

Specify whether to split a file by the specified unit and transmit the split files at the interval during file transmission to an agent.

Selected

Interval transmissions are performed.

Not selected

Interval transmissions are not performed.

Not selected

Number of continuous transmission buffers

Specify the number of buffers to be used for one file transmission.

1 to 4294967295

1

Transmission interval

Specify the interval (suspension period) between interval transmissions.

1 to 4294967295

1000

#1: For the Citrix XenApp and Microsoft RDS server, specify "Not selected" because displaying dialog boxes indicating that a job is being processed is not supported.

#2: A program created by a user for displaying dialog boxes does not have to display a dialog box. However, it must satisfy the conditions below, including parameters and the window name. Even if the specified user program does not display a dialog box correctly due to an error in the settings, or other reason, the processing continues regardless of the user program's behavior.

The specification format of the arguments that are passed to a program for displaying dialog boxes is shown below. Refer to this format when you create a user program.

Format

parameter-1 parameter-2 parameter-3 parameter-4

parameter-1

Specify whether to always display dialog boxes on top (1 single-byte character).

1: Dialog boxes are not displayed on top.

2: Dialog boxes are always displayed on top.

parameter-2

Specify the type of dialog box being processed (1 single-byte character).

1: Dialog box during download

2: Dialog box during installation

parameter-3

Package ID (1 to 44 single-byte characters)

parameter-4

Package name (1 to 50 single-byte characters or 1 to 25 double-byte characters)

Example

The following are examples for specifying individual types of dialog boxes:

Dialog box during download

1 1 package-ID package-name

Dialog box during installation (when it is not displayed on top)

1 2 package-ID package-name

Dialog box during installation (when it is always displayed on top)

2 2 package-ID package-name

Window name of the dialog box to be displayed

The window name must be the ones shown below. If you set a window name other than these, you will not be able to hide the dialog box. For the katakana in the window name, specify single-byte kana characters.

Dialog box during download

IT Desktop Management 2 - Download

Dialog box during installation

IT Desktop Management 2 - Installation

JP1/IT Desktop Management 2 issues the PostMessage function (with WM_CLOSE specified) to direct the user program to stop displaying the dialog box, and then issues the TerminateProcess function to stop the user program process.

#3: Select this check box when you want to reduce the network load. Note that, even if a package for which split distribution is set is distributed, split distribution is not performed if this check box is cleared.

#4: This setting is ignored for the relay system.

#5: Because the Citrix XenApp and Microsoft RDS server does not allow users to put jobs on hold, clear this check box.

#6: When a job is transmitted from the higher system, the JP1/IT Desktop Management 2 Job Suspended dialog box is displayed, and the user can select whether to execute the job. If the user does not want to execute the job immediately, execution of the job can be temporarily suspended. Note that only the Install package jobs in the GUI installation mode can be suspended unless the execution date (installation date and time of the package, or execution date and time of the job) is specified.

#7: The specified number of seconds is displayed (as the remaining time until the execution) in the JP1/IT Desktop Management 2 Job Suspended dialog box. If the value becomes 0, the displayed job is automatically executed, and the dialog box closes.

#8: The JP1/IT Desktop Management 2 Job Suspended dialog box remains displayed until the user operates on the dialog box.

#9: Usually, the display of the Job status window changes at each notification because there is a time gap until completion (or failure) of installation or collection is reported to the higher system after completion of job distribution. However, completion or failure might be reported immediately after notifications on jobs waiting to be installed and collected. If you suppresses notifications, you can reduce the network load (traffic of 170 bytes (340 bytes for ID jobs) for each notification), You can also reduce update processing for the job status on the higher system. You can suppress the following types of jobs:

Install package

Collect files from agent

Remote-collect files from agent to relay computer

When the above types of jobs are executed, notifications are suppressed if both Job specification and Suppression condition in the following table are satisfied.

Job specification

Suppression condition

Installation date/time

Install when system starts

GUI installation mode

Yes#1

No

No

The specified date and time had passed when distribution of the job was completed.

No

Yes

No

Before the system starts has been set for Polling timing on the agent.

The job was distributed during polling at system startup.

Yes

Yes

No

Before the system starts has been set for Polling timing on the agent.

The job was distributed during polling at system startup.

The specified date and time had passed when distribution of the job was completed.

No

No

Yes#2

Logon to the agent had finished when distribution of the job was completed.

Yes

No

Yes#2

The specified date and time had passed when distribution of the job was completed.

Logon to the agent had finished when distribution of the job was completed.

No

Yes

Yes#2

Before the system starts has been set for Polling timing on the agent.

The job was distributed during polling at system startup.

Logon to the agent had finished when distribution of the job was completed.

Yes

Yes

Yes#2

Before the system starts has been set for Polling timing on the agent.

The job was distributed during polling at system startup.

The specified date and time had passed when distribution of the job was completed.

Logon to the agent had finished when distribution of the job was completed.

Legend: Yes: Specified. No: Not specified.

#1: The Collect files from agent and Remote-collect files from agent to relay computer jobs are not subject to suppression.

#2: Only the Install package jobs are subject to suppression.

Communication settings

Item

Description

Specifiable values

Default

Settings to perform polling for multiple higher systems#1

Perform polling for multiple higher systems

Specify whether to perform polling (monitoring of directions from the managing server) for multiple higher systems when the managing server can execute a job using multiple paths.#2

The following higher systems can be set for the polling targets:

Management server

Relay system

Do not set to perform polling for multiple higher systems in the following cases:

When you create an agent configuration to be assigned to the relay system

When you edit the default agent configuration

Selected

Polling is performed for multiple higher systems.

To add a higher system to the polling targets, click the Add button. Then, in the displayed dialog box, specify the host name or IP address, type, and priority of the higher system.

The added higher systems are displayed in Higher-level system to be polled in the order of a priority.#3

Not selected

Polling is not performed for multiple higher systems.

Not selected

Type of polling for multiple higher systems

Select, from the drop-down list, the type of polling to be performed when the relay system (the polling-target higher system) cannot be connected due to a failure.

Hot standby

Polling is performed for higher systems displayed in Higher-level system to be polled in the order of higher priority, and then a higher system that can be connected is regarded as the polling-target higher system.#4

To add a higher system to the polling targets, click the Add button. Then, in the displayed dialog box, specify the host name or IP address, type, and priority of the higher system.

Select the type of polling at system startup (the first polling) from the following three types:

Poll all higher systems when the system starts

Poll only higher systems whose priority is 1 when the system starts

Poll higher systems according to their priority when the system starts

Multiple hosts

Polling is performed for all higher systems.

Hot standby (Poll all higher systems when the system starts)

Communication protocol for receiving execution requests

Use the received IP address for connections with higher systems#5

Specify whether to allow connection to the higher system even when name resolution for the higher system is not available.

Selected

Connection to the higher system is available because when an execution request is received from the higher system, the IP address of the higher system in that request information is saved.

Not selected

Connection to the higher system is not available when name resolution for the higher system is not available.

Selected

Communication error settings

Timing to assume that a communication error occurred

Specify whether the agent will wait for responses from communication software and assume that a communication failure occurred if no response is received.

Assume that a communication failure occurred if no response is received from communication software within the specified period

Specify the time to wait for responses from communication software in the range from 1 to 120 minutes.#6, #12

Do not monitor responses from communication software

Responses from communication software is not monitored.

Assume that a communication failure occurred if no response is received from communication software within the specified period (5 minutes)

Settings to perform retries when an error occurs

Perform a retry when a socket connection establishment error occurs, and when a file transmission error occurs

Specify whether to perform a retry when a socket connection establishment fails or when a communication error occurs during file transmission from the higher system to the agent.#7

Selected

A retry is performed.

Not selected

No retry is performed.

Selected

Retry count

Specify the number of retries that are allowed when a socket connection establishment fails or when a communication error occurs during file transmission.

1 to 999

5

Retry interval

Specify the retry interval (in seconds) for when a socket connection establishment fails or when a communication error occurs during file transmission.

1 to 7200

5

Non-transmitted processing result files

Retransmit non-transmitted processing result files to higher systems

Specify whether to retry a transmission when there is a notification file that has not been sent to the higher system.

Selected

A retry is performed.

Not selected

No retry is performed.

Selected

Retry count

Specify whether to specify the retry count of transmissions when there is a notification file that has not been sent to the higher system.

Specify

Specify the retry count in the range from 1 to 300.

Do not limit

Retries are repeated until all notification files have been transmitted.

Specify (2)

Retry interval

Specify the retry interval (in seconds) for transmissions when there is a notification file that has not been sent to the higher system.#8

60 to 3600

300

Multicast distribution settings (distribution by Remote Install Manager)

Use the multicast address to transmit jobs

Specify whether to use the multicast address to transmit jobs during distribution using Remote Install Manager.

Selected

The multicast address is used to transmit jobs during distribution using Remote Install Manager.

Not selected

The multicast address is not used to transmit jobs during distribution using Remote Install Manager.

Not selected

Multicast address

Specify the multicast address that is to be used to transmit jobs for which multicast distribution is specified.

Specify the multicast address that has been set for the connection-destination higher system.#9

224.0.1.0 to 239.255.255.255

238.255.0.1

Upper limit of the job transmission packet size

Specify the size of a packet used for distribution of jobs.

1 to 60

40#10

Use the multicast address to receive jobs

Specify whether to use the multicast address to receive jobs during distribution using Remote Install Manager.

Selected

The multicast address is used to receive jobs during distribution using Remote Install Manager.

Not selected

The multicast address is not used to receive jobs during distribution using Remote Install Manager.

Not selected

Port number

Normal reception

Specify the port number used to receive jobs during multicast distribution.

1 to 65535

The port number specified for Multicast distribution of Port numbers under Multicast Distribution in the Setup for Distribution by Using Remote Install Manager dialog box during the management server setup

Reception for retransmissions

Specify the port number used when retransmissions of packets occur during multicast distribution.#11

1 to 65535

The port number specified for Multicast distribution (when retransmission is required) of Port numbers under Multicast Distribution in the Setup for Distribution by Using Remote Install Manager dialog box during the management server setup

Multicast address

Specify the multicast address that is to be used to receive jobs for which multicast distribution is specified.

Specify the multicast address that is set for the connection-destination higher system.#9

224.0.1.0 to 239.255.255.255

238.255.0.1

#1

This setting is ignored for the relay system.

#2

Usually, the agent receives a direction from the managing server and executes the requested processing. However, no directions might be received as a result of, for example, a communication error, or the agent not running. In such a case, the agent can use polling to receive directions. If you use client control, Hitachi recommends that you use polling. If you use a low-speed WAN, you can reduce unnecessary data transmissions and receptions by not using polling.

#3

The higher system with the highest priority displayed in Higher-level system to be polled is always the same as the one specified in Higher-level system for distribution that uses Remote Install Manager of Basic settings.

#4

If the connection to the polling-target higher system becomes unavailable, polling is performed for the higher systems in the order of higher priority, and then a new polling-target higher system is determined.

#5

This setting is not necessary if the ID key for operations is an IP address.

If the higher system is a cluster system, connection with the higher system might not be correctly established.

In an environment in which the higher system uses multiple network adapters, connection with the higher system might not be correctly established.

#6

You can monitor the agent's processing, such as downloading files.

#7

If a retry is performed, the file transmission resumes from the point where the file transmission was suspended. Thus, you can reduce unnecessary traffic because the part of the file that has already been transmitted before the communication error will not be transmitted again. Note that the retry count and retry interval that are specified here are enabled for unicast distribution only.

#8

For the retry interval for transmissions when there is a notification file that has not been sent to the higher system, specify an appropriate value according to the system requirements. For example, for a security audit system (for which information from clients is immediately required), specify a small value.

#9

If you set for this item the multicast address that is set for the connection-destination higher system, this system will be registered in the multicast group that was set as the distribution destination of the higher system.

#10

A value of 40 KB is efficient enough for 100BASE communication lines. If the communication line is 10BASE, specify 4 KB. Note that, if the packet size is too large, multicast distribution might fail and change to unicast distribution from the middle of distribution.

#11

Because multicast distribution uses the UDP protocol, resending of packets occurs during distribution. Therefore, you must set the port number used for a request for resending.

#12

If Basic Settings - Internet Connection Settings - Perform HTTPS communication with the higher system via the Internet Gateway is enabled, set 30 minutes for Timing to assume that a communication error occurred. However, when collecting files with large capacity exceeding 1 GB with the remote collection function, set the value to 120 minutes. If the setting value is increased, when there is no response from the server due to a temporary failure such as communication failure or server failure, it takes time until it is assumed as an error, so the time to the next polling will be longer.

Startup settings

Item

Description

Specifiable values

Default

Create the startup folder (ITDM2_Startup) for only IT Desktop Management 2#1

Specify whether to create the ITDM2_Startup folder that is used to move the programs registered in the Windows Startup group.#2

Selected

The ITDM2_Startup folder is created.

Not selected

The ITDM2_Startup folder is not created.

Not selected

Move startup programs into the ITDM2_Startup folder

If you create the ITDM2_Startup folder, specify whether to automatically move the programs registered in the Windows Startup group to the ITDM2_Startup folder on the agent.

Selected

The programs registered in the Windows Startup group are automatically moved to the ITDM2_Startup folder.

To move a specific program to the ITDM2_Startup folder, click the Add button. Then, in the displayed dialog box, specify the program. The specified program is displayed in Startup program (shortcut file) to be moved.

Not selected

The programs registered in the Windows Startup group are not automatically moved to the ITDM2_Startup folder.

Not selected

#1: The ITDM2_Startup folder has not been created by default.

#2: If you move the programs registered in the Windows Startup group to the ITDM2_Startup folder, you can avoid installation failure of packages for which Install when system starts is set. This installation failure is caused by the conflict between the installation of packages for which Install when system starts is set and the startup of the programs registered in the Windows Startup group on the agent.

AMT Settings

Item

Description

Specifiable values

Default

Allow IDE Redirection

Specify whether to use the AMT IDE redirection function to use the remote CD-ROM function during remote control.

Selected

The remote CD-ROM function is used.

Not selected

The remote CD-ROM function is not used.

Not selected

Allow Remote KVM

Specify whether to use the AMT remote KVM function to enable remote control of computers via RFB connection.

Selected

Remote control of computers via RFB connection is enabled.

Not selected

Remote control of computers via RFB connection is disabled.

Not selected

Password

Specify the password required for using the remote KVM function of the destination computer.

A character string of 8 or fewer single-byte characters#

(Blank)

Retype Password

Enter the specified password again for confirmation.

A character string of 8 or fewer single-byte characters#

(Blank)

Confirm permission for the connection to the user.

Specify whether to display a confirmation dialog box during connection to a computer.

Selected

A confirmation dialog box is displayed during connection to the computer.

Not selected

No confirmation dialog box is displayed during connection to the computer.

Selected

Display time of dialog (seconds)

Specify how long (seconds) the connection confirmation dialog box is displayed.

10 to 4095

300

Session Timeout (minutes)

Select whether a timeout occurs when the computer cannot be connected to.

Do

A timeout occurs. Specify, in the range from 1 to 255, the wait time (minutes) that can elapse before a timeout occurs.

Not Do

A timeout does not occur.

Not Do

Default Screen

Select the display to be used when the destination computer has a dual display.

Primary

Secondary

Primary

#

You need to use at least one character for each of the following types:

Uppercase letter

Lowercase letter

Number

Symbols other than ", comma (.), and colon (:)

Remote control settings

Item

Description

Specifiable values

Default

Activation Process

Remote Control Agent Starts Automatically

Specify whether to automatically start Remote Control Agent when the agent starts.

Selected

Remote Control Agent starts automatically.

Not selected

Remote Control Agent does not start automatically.

Selected

Display Icon in Taskbar

Specify whether to display an icon on the Windows taskbar when Remote Control Agent is running.

Selected

An icon is displayed.

Not selected

An icon is not displayed.

Selected

Allow end user to terminate the remote control session in Agent

Specify whether to allow the user to terminate Remote control Agent.

Selected

The user is allowed to terminate Remote Control Agent.

Not selected

The user is not allowed to terminate Remote Control Agent.

Not selected

After Disconnecting Remote Control

Select the processing to be performed when connection between Remote Control and the management server is disconnected.

Keep Remote Control Agent Running

Terminate Remote Control Agent

Keep Remote Control Agent Running

Connection Settings

Remote Control Port

Specify the port number used for the standard connection.

1 to 65532

The port number specified for Remote Control port number in the Port Number Settings dialog box during the management server setup

RFB Port

Specify the port number used for the RFB connection.

1 to 65535

5900

Request Server

Connection Destination

Specify the default destination used when a computer requests connections.

Host name# or IPv4 address

Host name or IP address of the management server

File Transfer

Select whether to allow file transfer between the management server and computers.

Deny File Transfer

Allow File Transfer

Allow File Transfer

Read File From Agent

Specify whether to allow reading files from the computer during file transfer.

Selected

Reading files from the computer is allowed.

Not selected

Reading files from the computer is not allowed.

Selected

Write File to Agent

Specify whether to allow writing files to the computer during file transfer.

Selected

Writing files to the computer is allowed.

Not selected

Writing files to the computer is not allowed.

Selected

Chat

Start the chat server when remote control agent starts

Specify whether to start the chat server when Remote Control Agent starts.

Selected

The chat server is started.

Not selected

The chat server is not started.

Not selected

Display Icon in Taskbar

Specify whether to display an icon on the Windows taskbar when the chat server is running.

Selected

An icon is displayed.

Not selected

An icon is not displayed.

Selected

Open chat window when chat client connects chat server

Specify whether the Chat window opens automatically when another computer establishes a chat connection while the chat server is running.

Selected

The Chat window opens automatically.

Not selected

The Chat window does not open automatically.

Not selected

Settings of allowed controllers

Allowed Controller List

Specify a computer or computers allowed for remote control only when you want to limit the computers that are allowed to use the remote control function.

Host name or IPv4 address

None

User Authentication

Allowed Use List

Specify the authentication information that the controller will be asked for during remote control connection.

Windows authentication information or any authentication information (user name and password)

None

Connection Confirmation

Display user-response dialog box on user computers

Specify whether to display a confirmation dialog box for remote control during connection from the management server.

Selected

A confirmation dialog box is displayed during connection.

Not selected

A confirmation dialog box is not displayed during connection.

Not selected

Dialog box display

Specify the display period of a confirmation dialog box that asks the user for permission for remote control.

Specify the display period

Specify, in the range from 1 to 180 seconds, the display period of a confirmation dialog box that asks the user for permission for remote control.

Keep the dialog box displayed until a response is received

A dialog box remains displayed until user response is received.

Specify the display period (10 seconds)

When no user response is received

Select the operation to be performed when the user does not respond to the confirmation dialog box that asks the user for permission for remote control.

Connect

Do not connect

Connect

Connection Mode

Select the connection mode to be allowed by the destination computer.

Exclusive

Shared

View

Shared

#

Specify the host name using a character string of 255 or fewer characters.

(5) Installation set parameters

The following tables list and describe the parameters in the Installation Set Creation dialog box that opens from Windows Agent Configurations and Create Agent Installers view in the Settings module.

Installation folder settings

Item

Description

Specifiable values

Default

Installation folder

Specify the path name to the folder in which JP1/IT Desktop Management 2 - Agent is to be installed.

A path consisting of 104 or fewer characters#

%ProgramFiles%\Hitachi\jp1itdma

Generate the host ID based on information about the virtual computer.

Select whether to generate host IDs from virtual computer information by using agents installed on shared VDI-based virtual computers.

Selected

A host ID is generated based on virtual computer information.

Not selected

A host ID is not generated based on virtual computer information.

Not selected

If you have selected the Generate the host ID based on information about the virtual computer. check box, select which information item is to be used to generate host IDs.

Computer Name

Account Name

IP Address

Computer Name

#: Available characters are single-byte alphanumeric characters, single-byte spaces, periods (.), parentheses, colons (:), underscores (_), and backslashes (\).

Account settings

Item

Description

Specifiable values

Default

Set the account to install Agent.

Specify whether to set account information required for users who do not have administrator permissions to install agents.

Selected

The account information required for users who do not have administrator permissions to install agents is set.

Not selected

The account information required for users who do not have administrator permissions to install agents is not set.

Not selected

Administrative Account Name

Specify an account (user name) who has administrator permissions.

A character string of 276 or fewer single-byte characters

(Blank)

Password

Specify the password for the account (user name) who has administrator permissions.

A character string of 128 or fewer single-byte characters

(Blank)

Confirm password

Re-enter the specified password for confirmation.

Tip

The Set the account to install Agent checkbox is provided to avoid unintentionally updating Administrative Account Name/Password. Administrative Account Name/Password is saved in the installation set regardless of the checked state of the checkbox.

Component settings

Item

Description

Specifiable values

Default

Component to be installed

Specify the type of component to be installed (whether the component is to be installed as an agent or relay system).#1

JP1/IT Desktop Management 2 - Agent (agent)

JP1/IT Desktop Management 2 - Agent (relay system)

Agent

Remote control agent

Specify whether to install Remote Control Agent.#2

Selected

Remote Control Agent is installed.

Not selected

Remote Control Agent is not installed.

Selected

#1: For the Citrix XenApp and Microsoft RDS server, select "Agent" because a relay system is not supported.

#2: For the Citrix XenApp and Microsoft RDS server, select "Not selected" because Remote Control Agent is not supported.

Settings for the registration-destination ID

Item

Description

Specifiable values

Default

Registration-destination ID

Specify the ID for agent registration (the group used for receiving jobs from the managing server).

You can create an ID by entering the ID name in the dialog box opened by clicking the Register button.

A character string of 32 or fewer characters

(Blank)

Settings for the file to be deployed

Item

Description

Specifiable values

Default

Files to be deployed

Specify the files to be deployed upon agent installation (and the deploy-destination folder) in the dialog box opened by clicking the Add button.

Files to be deployed

A character string of 100 or fewer characters

Deploy-destination folder

A character string of 255 or fewer single-byte characters

(Blank)

Settings for the file to be automatically executed

Item

Description

Specifiable values

Default

Files to be automatically executed#1

Specify the program that is to be automatically executed after agent installation, the files required for automatic execution, and the arguments#2 in the dialog box opened by clicking the Add button.

The name of the program to be automatically executed, and the name of files required for automatic execution

A character string of 100 or fewer characters#3

File path

A character string of 255 or fewer single-byte characters

Automatically execute this file after installing the agent

Select this option if you want the specified file to be automatically executed after the agent is installed. This option is available if you specify, as the file to be automatically executed, a file other than a ZIP file. Alternatively, this option is available if you specify a ZIP file as the file to be automatically executed and select Use this Archived File without Expanding it for Expansion Category.

Parameter

If you want the specified file to be automatically executed after the agent is installed, specify the necessary parameters in no more than 127 characters.

If the file to be automatically executed is a ZIP file, specify the following items:

Expansion Category

Specify whether the ZIP file is to be used without being expanded or whether the ZIP file is to be expanded and then automatically executed after the agent is installed.

Type of File to Be Executed

If you specified Expand this Archived File, and Execute it Automatically after Installing the Agent for Expansion Category, specify whether the file to be executed is the Hibun installer.

Path of File to Be Executed

If you specified Expand this Archived File, and Execute it Automatically after Installing the Agent for Expansion Category, click the Select File to Be Executed Automatically in the Expanded Folder button. A window will appear, displaying the path of the specified program file (such as setup.exe) to be automatically executed after the agent is installed.

Specify the expansion folder for the files.

Select whether you want to specify the folder to which the compressed file is to be expanded. This option is available if non-HIBUN Installer is specified for Type of File to Be Executed.

Expand Folder

If you specified non-HIBUN Installer for Type of File to Be Executed, specify a valid folder on the computer where the compressed file is to be expanded. Specify a folder by using no more than 259 characters.#4

File Name

(Blank)

Automatically execute this file after installing the agent

Not selected

Expansion Category

Use this Archived File without Expanding it

Type of File to Be Executed

non-HIBUN Installer

Parameter

If Type of File to Be Executed is a Hibun installer, /b

Specify the expansion folder for the files.

Not selected

#1: To automatically install Hibun (Hibun DC or Hibun DE) or some other related product on an agent, first prepare (create) installation media containing the related product in a folder in C:\DATA on the administrator's computer. Compress the entire folder or all of the files in the folder to a ZIP file. Then, to automatically install the related product on an agent, specify this ZIP file as a file to be automatically executed after agent installation. For details about how to create installation media for Hibun, see the JP1 Version 11 JP1/HIBUN Installation and Setup (for Administrators).

#2: Specify each argument by using a character string of 127 or fewer characters.

#3: You cannot use single-byte double quotation marks ("), asterisks (*), forward slashes (/), left angle brackets (<), right angle brackets (>), question marks (?), backslashes (\), vertical bars (|), or colons (:).

#4: You cannot use single-byte double quotation marks ("), asterisks (*), forward slashes (/), left angle brackets (<), right angle brackets (>), question marks (?), or vertical bars (|).

Settings for an overwrite installation

Item

Description

Specifiable values

Default

Perform an overwrite installation of the agent

Specify whether to perform an overwrite installation if an agent has already been installed.

Selected

An overwrite installation is performed.

Not selected

An overwrite installation is not performed.

Selected

Register the agent to the specified registration-destination ID

Specify whether to register the agent to the specified ID upon overwrite installation.

Selected

The agent is registered to the specified ID upon overwrite installation.

Not selected

The agent is not registered to the specified ID.

Selected

Deploy the files specified in Files to be deployed

Specify whether to deploy the files specified in Files to be deployed upon overwrite installation.

Selected

The files specified in Files to be deployed are deployed upon overwrite installation.

Not selected

The files specified in Files to be deployed are not deployed.

Selected

Execute the files specified in Files to be automatically executed

Specify whether to execute the files specified in Files to be automatically executed upon overwrite installation.

Selected

The files specified in Files to be automatically executed are executed upon overwrite installation.

Not selected

The files specified in Files to be automatically executed are not executed.

Selected

(6) Parameters for configuring Active Directory searches

The following tables list and describe the parameters in the Active Directory view displayed from the Configurations view in the Settings module.

Discovery Schedule

Item

Description

Specifiable values

Default

Auto Discovery Schedule

Specify whether to set a schedule to perform searches regularly.

Selected

Searches are performed regularly according to a schedule.

Not selected

Regular searches are not performed.

Selected

Start At

Specify the start time for searches.

00:00 to 23:59

23:00

Repeat Interval

Specify the unit of the interval at which you want to perform searches.

Daily

Weekly

Monthly

Daily

Repeat

Specify details of the repeat interval.

The specifiable values depend on the item selected for Repeat Interval.

For Daily:

1 to 31

For Weekly:

Sunday to Saturday

For Monthly:

You can specify the date (1 to 31), or the week of the month (first to fourth or last) and the day of the week (Sunday to Saturday).

1

Discovery Option

Item

Description

Specifiable values

Default

Auto-Manage Discovered Nodes

Specify whether to automatically register discovered Windows computers as management targets.

Selected

The discovered computers are automatically registered as management targets.

Not selected

The discovered computers are not automatically registered as management targets.

Selected

Auto-Install Agent

Specify whether to automatically install agents on Windows computers discovered by a search.

Selected

Agents are automatically installed on the discovered computers.

Not selected

Agents are not automatically installed on the discovered computers.

Not selected

Notification of Discovery Completion

Item

Description

Specifiable values

Default

Report to

Specify the email notification destination to which notification emails are to be sent when the search finishes.

User accounts and email notification destinations that are registered in the Account Management view.

None

(7) Parameters for configuring network searches

The following tables list and describe the parameters in the IP Address Range view displayed from the Configurations view in the Settings module.

Search range settings

Item

Description

Specifiable values

Default

IP Address Range

Set the search range used for a network search.

A search range

Management server segment#

Discovery Range Name

Specify the name of the search range.

A name consisting of 255 or fewer characters

New search range name

From

Specify an IPv4 IP address as the start value of the search range.

An IPv4 IP address

(Blank)

To

Specify an IPv4 IP address as the end value of the search range.

An IPv4 IP address

(Blank)

Credentials Used

Specify the authentication information used to search the specified range.

Any

All the registered authentication information items are used.

Select

Select the authentication information you want to use.

Any

#: For the management server segment, the range of IP addresses in the network segment that contains the management server is specified, and Any is selected for Credentials Used.

Credentials Used

Item

Description

Specifiable values

Default

Credentials Used

Set the authentication information used for a network search.

Authentication information

SNMP standard#1

Credential Name

Specify the name used for managing authentication information.

A name consisting of 255 or fewer characters

New authentication name

Protocol

Select the type of authentication information.

SNMP

Windows

SNMP

Port#2

Specify the port number used by SNMP.

1 to 65535

161

Community Name#2

Specify the community name.

A name consisting of 255 or fewer single-byte characters

(Blank)

User ID#3

Specify the user ID with which Windows administrative shares can be authenticated.

To specify a domain user for authentication, use user-ID@FQDN (FQDN: Fully Qualified Domain Name) or domain-name\user-ID format. For FQDN, specify a full domain name without omitting host and subdomain names. For example: User001@PC001.hitachi.com.

An ID consisting of 276 or fewer characters

(Blank)

Password#3

Specify the password for the user ID.

A password consisting of 127 or fewer single-byte characters

(Blank)

Retype Password#3

Specify the password again.

A password consisting of 127 or fewer single-byte characters

(Blank)

#1: For SNMP standard, SNMP is selected for Protocol, 161 is specified for Port, and public is specified for Community Name.

#2: Displayed when SNMP is selected for Protocol.

#3: Displayed when Windows is selected for Protocol.

Discovery Schedule

Item

Description

Specifiable values

Default

Auto Discovery Schedule

Specify whether to set a schedule to perform searches regularly.

Selected

Searches are performed regularly according to a schedule.

Not selected

Regular searches are not performed.

Not selected

Start At

Specify the start time for searches.

00:00 to 23:59

12:00

Repeat Interval

Specify the unit of the interval at which you want to perform searches.

Daily

Weekly

Monthly

Daily

Repeat

Specify details of the repeat interval.

The specifiable values depend on the item selected for Repeat Interval.

For Daily:

1 to 31

For Weekly:

Sunday to Saturday

For Monthly:

You can specify the date (1 to 31), or the week of the month (first to fourth or last) and the day of the week (Sunday to Saturday).

1

Discovery Option

Item

Description

Specifiable values

Default

Auto-Manage Discovered Nodes

Specify whether to automatically register discovered Windows computers as management targets.

Selected

The discovered computers are automatically registered as management targets.

Not selected

The discovered computers are not automatically registered as management targets.

Selected

Auto-Install Agent

Specify whether to automatically install agents on Windows computers discovered by a search.

Selected

Agents are automatically installed on the discovered computers.

Not selected

Agents are not automatically installed on the discovered computers.

Not selected

Notification of Discovery Completion

Item

Description

Specifiable values

Default

Report to

Specify the email notification destination to which notification emails are to be sent when the search finishes.

User accounts and email notification destinations that are registered in the Account Management view.

None

(8) Agent deployment parameter

The following table shows the parameter in Windows Agent Deployment in the Settings module.

Item

Description

Specifiable values

Default

Settings of the Components of the Agents to Be Deployed

Specifies whether to include remote control agents in the agents to be deployed.

Include remote control agents

Do not include remote control agents

Include remote control agents

(9) Agentless management parameters

The following table lists and describes the parameters in the Agentless Management dialog box that opens from the Agent view in the Settings module.

Item

Description

Specifiable values

Default

Auto Monitoring Schedule

Select whether to collect device information from agentless devices regularly.

Selected

Device information is collected from agentless devices.

Not selected

Device information is not collected from agentless devices.

Selected

Update Interval

Specify the interval for collecting device information from agentless devices.

1 to 24

1

(10) Security schedule parameters

The following table lists and describes the parameters in the Security Schedule view that opens from the Settings module.

Item

Description

Specifiable values

Default

Judgment Time

Specify the time at which the computer security status is determined.

00:00 to 23:59

00:00

Judgment Interval (days)

Specify the interval (number of days) at which the security status is determined.

1 to 31

1

(11) Operation log settings parameters

The following tables list and describe the parameters in the Operation Log Settings view in the Settings module.

Automatic restoration of operation logs

Item

Description

Specifiable values

Default

Automatically restore operation logs

Specify whether to automatically restore the operation logs that are received.

Selected

Operation logs are automatically restored.

Not selected

Operation logs are not automatically restored.

Selected

Period for storing automatically restored operation logs

Specify the period for which automatically restored operation logs are to be stored in the operation log database.

1 to 300#

30

#: The maximum specifiable value is the value obtained by subtracting the manually restored days from the value specified in Maximum number of days for which operation logs are to be stored in the database during management server setup.

Export of operation logs

Item

Description

Specifiable values

Default

Periodically export operation logs

Specify whether to periodically export the operation logs that are received.

Selected

Operation logs are exported periodically.

Not selected

Operation logs are not exported.

Not selected

(12) Parameters for configuring automatic update of the network control list

The following table lists and describes the parameters in the Automatic Updates on Network Filter List view displayed from the Network Filter Settings view via the Network Access Control view of the Settings module.

Automatic Updates on Network Filter List

Item

Description

Specifiable values

Default

Enable all automatic updates

Select whether to enable automatic updating of the network control list.

Selected

Automatic updating of the network control list is enabled for all operations.

Not selected

Automatic updating of the network control list is enabled for add operations only.

Not selected

Range of targets subject to automatic updates of the Network Filter List

Item

Description

Specifiable values

Default

Set devices managed by management servers under the local server as the targets of automatic update

Specify whether to include the devices managed by the management relay server under the local server, in the automatic update target of the network control list.

Selected

Automatic updates are performed for the devices directly under the local server and for the devices managed by the management relay server under the local server.

Not selected

Automatic updates are performed only for devices under the local server.

Not selected

(13) AMT parameters

The following tables list and describe the parameters in the AMT Settings view that opens from Inventory in the Settings module.

Credentials Used

Item

Description

Specifiable value

Default

User ID

Enter the user ID used for connecting to AMT of a managed computer.

A string of no more than 64 ASCII characters that does not include control characters.

(Blank)

Password

Specify the password for the user ID.

A string of no more than 64 ASCII characters that does not include control characters.

(Blank)

Retype Password

Enter the password again for confirmation.

A string of no more than 64 ASCII characters that does not include control characters.

(Blank)

Password for administrative privileges

Item

Description

Specifiable value

Default

Password

Set the password for administrative privileges for AMT.

A string of 8 to 32 ASCII characters (0x20 to 0x7E)#1.

The password must contain at least one lowercase letter, one uppercase letter, one numeral, and one symbol#2.

(Blank)

Retype Password

Enter the password again for confirmation.

A string of 8 to 32 ASCII characters (0x20 to 0x7E)#1.

The password must contain at least one lowercase letter, one uppercase letter, one numeral, and one symbol#2.

(Blank)

#1: You cannot specify colons (:), commas (,), or double quotation marks (").

#2: You cannot specify underscores (_).

(14) Revision history configuration parameters

The table below shows the parameters in the Revision History Settings view displayed from the Device view in the Settings module.

Collection of revision history

Item

Description

Specifiable values

Default

Collect revision history#1

Specify whether to collect a revision history for device information.

Selected

A revision history of device information is collected.

Not selected

A revision history of device information is not collected.

Not selected

Collect the revision history of devices that are directly under the device.#2

Specify whether to collect a revision history of device information for the devices that are directly under the device.

Selected

A revision history of device information for the devices that are directly under the device is collected.

Not selected

A revision history of device information for the devices that are directly under the device is not collected.

Not selected

Collect the revision history of subordinate devices.#2

Specify whether to collect a revision history of device information reported from a lower management relay server.

Selected

A revision history of device information that is reported from a lower management relay server is collected.

Not selected

A revision history of device information that is reported from a lower management relay server is not collected.

Selected

#1: This parameter is displayed in a minimum configuration or basic configuration.

#2: This parameter is displayed in a multi-server configuration.

Revision History Collection Targets

Item

Description

Specifiable values

Default

Device Inventory

Select the device information for which to acquire revision history.

Selected

A revision history is kept for the selected item.

Not selected

A revision history is not kept for the item.

All device information is selected

(15) Parameters for the report duration and start date

The following table lists and describes the parameters in the Duration and Start Date view that opens from Reports in the Settings module.

Item

Description

Specifiable values

Default

Select the storage duration of the report.

Specify the storage duration of reports.

1 year to 10 years

5 years

Select the start day of week.

Specify the start day of the week on which reports are calculated.

Sunday to Saturday

Monday

Select the start day of month.

Specify the start day of the month on which reports are calculated.

1 to 31

1

Select the start month of year.

Specify the start month of the year on which reports are calculated.

January to December

April

(16) Summary report parameters

The following tables list and describe the parameters in the Summary Report Notifications view that opens from Reports in the Settings module.

Daily Summary

Item

Description

Specifiable values

Default

Select Daily Summary recipients

Select the user ID or email notification destination to which daily summary notification emails are to be sent. If a user ID does not have a set email address, enter an email address.

Email character string

User accounts and email notification destinations that are registered in the Account Management view.

Weekly Summary

Item

Description

Specifiable values

Default

Select Weekly Summary recipients

Select the user ID or email notification destination to which weekly summary notification emails are to be sent. If a user ID does not have a set email address, enter an email address.

Email character string

User accounts and email notification destinations that are registered in the Account Management view.

Monthly Summary

Item

Description

Specifiable values

Default

Select Monthly Summary recipients

Select the user ID or email notification destination to which monthly summary notification emails are to be sent. If a user ID does not have a set email address, enter an email address.

Email character string

User accounts and email notification destinations that are registered in the Account Management view.

(17) Event notification parameters

The following tables list and describe the parameters in the Event Notifications view that opens from Events in the Settings module.

Select the category and severity of events about which you want to be notified by email:

Item

Description

Specifiable values

Default

Critical, Warning, and Information

Select the severity (Critical, Warning, and Information) of events for which you want to send notification emails.

Selected

Event notification emails are sent.

Not selected

Event notification emails are not sent.

Only Critical is selected.

Security

Set events related to security management, such as changes and allocation of policies, judgement results, action results, and startup suppression.

Selected

Notification emails for the selected events.

Not selected

Event notification emails are not sent.

All categories under Critical are selected.

Suspicious Operations

Set events related to suspicious operations, such as detection of emails with attachments, detection of file upload to a Web server or FTP server, and detection of copying or moving of files to external media.

Assets

Set events related to asset management, such as asset registration, change of the asset status, and addition or deletion of software licenses.

Distribution (ITDM-compatible)

Set events related to ITDM-compatible distribution functions, such as installation and uninstallation of software, and distribution of files.

Inventory

Set events related to device management, such as addition and deletion of software, and addition and deletion of computer accounts.

Settings

Set events related to settings, such as discovery of devices, addition of management targets, and agent distribution.

Relay

Set events related to data relays between management servers. This type of event is only output in a multi-server configuration.

Error

Set events related to errors that occur in functions.

Select recipients:

Item

Description

Specifiable values

Default

Select recipients

Select the user ID or email notification destination to which event notification emails are to be sent. If a user ID does not have a set email address, enter an email address.

Email character strings

User accounts and email notification destinations that are registered in the Account Management view.

Interval of notification

Item

Description

Specifiable values

Default

Interval of notification

Specify the interval (number of minutes) at which event notifications are sent.

1 to 1440

30

(18) Mail server parameters

The following table lists and describes the parameters in the SMTP Server view that opens from General in the Settings module.

SMTP Server Settings

Item

Description

Specifiable values

Default

Host Name

Enter the host name of the SMTP server.

The host name of the SMTP server

(Blank)

Secure Connection

Select the security protection used for communication with the SMTP server.

Plain

TLS

Plain

Port

Specify the port number of the SMTP sever.

1 to 65535

25

Source E-mail

Specify the source email address of notification emails.

Email character string

(Blank)

Use Authentication

Select Use Authentication to use the user authentication function (SMTP Authentication) on the SMTP server.

Selected

SMTP authentication is used.

Not selected

SMTP authentication is not used.

Not selected

User ID

Enter the user ID used for user authentication.

User ID used for user authentication

(Blank)

Password

Specify the password for the user ID.

Password for the user ID

(Blank)

Retype Password

Enter the password again for confirmation.

Password for confirmation

(Blank)

(19) Active Directory parameters

The following table lists and describes the parameters in the Active Directory view that opens from General in the Settings module.

Item

Description

Specifiable values

Default

Get Department Hierarchy Information

Specify whether to acquire the organization hierarchy from Active Directory and apply it to the group configuration of the department.

Selected

Organization hierarchy information managed by Active Directory is applied to the group configuration of the department.

Not selected

Organization hierarchy information managed by Active Directory is not applied to the group configuration of the department.

Not selected

Domain Name

Specify the domain name of the Active Directory server.

A character string of 0 to 255 ASCII characters that does not include the following. Domain names cannot begin with a period (.).

ASCII control characters

Single-byte spaces, exclamation marks (!), double quotation marks ("), hash marks (#), dollar signs ($), percent signs (%), ampersands (&), parentheses, asterisks (*), plus signs (+), commas (,), single quotation marks ('), forward slashes (/), colons (:), semicolons (;), left angle brackets (<), equal signs (=), right angle brackets (>), question marks (?), at marks (@), left square brackets ([), backslashes (\), right square brackets (]), carets (^), grave accent marks (`), left curly brackets ({), vertical bars (|), right curly brackets (}), and swung dashes (~)

(Blank)

Host Name

Specify the host name of the Active Directory server (fully modified domain name).

A character string of 0 to 255 ASCII characters that does not include control characters

(Blank)

Port

Enter the port number used for connecting to the Active Directory server.

1 to 65535

389

User ID

Enter the user ID used for connecting to the Active Directory server.

A character string of 0 to 276 ASCII characters that does not include control characters

(Blank)

Password

Specify the password for the user ID.

A character string of 0 to 64 ASCII characters that does not include control characters

(Blank)

Retype Password

Enter the password again for confirmation.

A character string of 0 to 64 ASCII characters that does not include control characters

(Blank)

Root OU

Enter the domain name and OU names separated by slashes (/) to specify the path to the root organizational unit (OU) for which you want to acquire information. The entered values are not case sensitive. For example, when the domain name is hitachi.co.jp and the OU names are general affairs department and general affairs section, enter hitachi.co.jp/general affairs department/general affairs section. The domain name must be entered. OU names are optional. When you acquire information on a department, the hierarchy under the path specified here is applied to the group configuration of the department.

A character string of 0 to 256 ASCII characters that does not include control characters

(Blank)

TLS

Specify whether to enable TLS (Transport Layer Security) communication.

Selected

TLS is enabled.

Not selected

TLS is not enabled.

Not selected

(20) Support service parameters

The following tables list and describe the parameters in the Product Update view that opens from General in the Settings module.

Customer Support configuration

Item

Description

Specifiable values

Default

Enable Product Update

Specify whether to acquire the latest Windows update information and anti-virus products information from the support service site.

Selected

Connect to the support service site.

Not selected

Do not connect to the support service site.

Not selected

URL

Specify the URL of the support service site.

No restrictions

https://www.hitachi-support.com/jp1itdm

Download User ID

Specify the authentication ID of the Web server.

No restrictions

(Blank)

Password

Specify the password for the download user ID.

No restrictions

(Blank)

Retype Password

Enter the password again for confirmation.

No restrictions

(Blank)

Start At

Specify the time at which to connect to the support service.

00:00 to 23:59

The time when the setup for the management server was completed, rounded up to the nearest hour.#

Repeat Interval

Select Daily, Weekly, or Monthly as the unit of the interval at which you want to establish a connection.

Daily

Weekly

Monthly

Daily

Repeat

Specify details of the repeat interval.

The specifiable values depend on the item selected for Repeat Interval.

For Daily:

1 to 31

For Weekly:

Sunday to Saturday

For Monthly:

You can specify the date (1 to 31), or the week of the month (first to fourth, or last) and the day of the week (Sunday to Saturday)

1

Specify users to receive Product Update notification e-mails.

Select the user ID or email notification destination to which notification emails about product updates are to be sent. If a user ID does not have a set email address, enter an email address.

Email character string

User accounts and email notification destinations that are registered in the Account Management view.

#: For example, if the setup time is 10:30, the download starts at 11:00.

Proxy Server configuration

Item

Description

Specifiable values

Default

Use Proxy Server

Select this option when using a proxy server.

Selected

A proxy server is used.

Not selected

A proxy server is not used.

Not selected

IP Address

Enter the IP address of the proxy server.

An IPv4 IP address

(Blank)

Port

Enter the port number of the proxy server.

1 to 65535

0

User ID

Enter the user ID used for connecting to the proxy server.

A user ID used for connecting to the proxy server

(Blank)

Password

Specify the password for the user ID.

The password for the user ID

(Blank)

Retype Password

Enter the password again for confirmation.

The password for confirmation

(Blank)

(21) MDM linkage parameters

The following tables list and describe the parameters in the MDM Linkage Settings view that opens from General in the Settings module.

MDM Linkage Settings

Item

Description

Specifiable values

Default

MDM setting name

Specify the name of the setting.

A character string of 255 or fewer characters

(Blank)

MDM system

Select the MDM system you want to connect to.

JP1/ITDM2 - SD Manager

MobileIron

Microsoft Intune

(Blank)

Host name of MDM server

Specify the common name (CN) assigned to the server certificate of the MDM system.

If you are using MobileIron, specify the CN in FQDN format.

A character string of 255 or fewer characters

For JP1/ITDM2-SD Manager and MobileIron

(Blank)

For Microsoft Intune

graph.microsoft.com

Port number of MDM server

Specify the port number used for connecting to the MDM system.

If no value is specified, the port number 443 is used for connection.

1 to 65535

(Blank)

URL

Specify the URL of the MDM system.

A character string of 0 to 2,083 characters

For JP1/ITDM2-SD Manager and MobileIron

(Blank)

For Microsoft Intune

https://intune.microsoft.com/#home

User ID#1

Specify the user ID used to log in to the MDM system.

A character string of 276 or fewer characters

(Blank)

Password#1

Specify the password used to log in to the MDM system.

A character string of 90 or fewer characters

(Blank)

Retype Password#1

Enter the password again for confirmation.

A character string of 128 or fewer characters

(Blank)

Application (client) ID#2

Specify ID assigned to the application registered in Microsoft Entra ID.

A character string of 276 or fewer characters

(Blank)

Directory (Tenant) ID#2

Specify the tenancy ID displayed in Microsoft Entra ID.

A character string of 276 or fewer characters

(Blank)

Authentication-method#2

Specify how to authenticate to Microsoft Entra ID.

Client secret

Certificate

Client secret

Client secret value#2

Specify the key for the application registered in Microsoft Entra ID to connect.

A character string of 276 or fewer characters

(Blank)

Installed OS#2

Specify OS to be imported from Microsoft Intune.

iOS

Android

Windows

All options are off

#1: This item cannot be specified when Microsoft Intune is used for MDM system.

#2: This item can be specified only when Microsoft Intune is used for MDM system.

Proxy Server configuration

Item

Description

Specifiable values

Default

Use Proxy Server

Select this option when using a proxy server.

Selected

A proxy server is used.

Not selected

A proxy server is not used.

Not selected

IP Address

Enter the IP address of the proxy server.

An IPv4 IP address

(Blank)

Port

Enter the port number of the proxy server.

1 to 65535

(Blank)

User ID

Enter the user ID used for connecting to the proxy server.

A user ID used for connecting to the proxy server

(Blank)

Password

Specify the password for the user ID.

The password for the user ID

(Blank)

Retype Password

Enter the password again for confirmation.

The password for confirmation

(Blank)

Collection Schedule

Item

Description

Specifiable values

Default

Start At

Specify the time at which information is collected from the MDM system.

00:00 to 23:59

(Blank)

Repeat Interval

Select Daily, Weekly, or Monthly as the unit of the interval at which you want to collect information.

Daily

Weekly

Monthly

Daily

Repeat

Specify details of the repeat interval.

The specifiable values depend on the item selected for Repeat Interval.

For Daily:

1 to 31

For Weekly:

Sunday to Saturday

For Monthly:

You can specify the date (1 to 31), or the week of the month (first to fourth or last) and the day of the week (Sunday to Saturday).

1

Control of Malware-Infected Devices

Item

Description

Specifiable values

Default

Enable Control of Malware-Infected Devices

Select to control malware-infected devices.

Selected

Enable control of malware-infected devices.

Not selected

Does not enable control of malware-infected devices.

Not selected

Acquisition Interval

Sets the number of minutes between attempts to acquire malware-infected device inventory from Microsoft Intune.

1 to 1440

10

Block the network connection of the device if malware infection is detected

Select to block network connection of a malware-infected device.

Selected

If a malware infection is detected, the device's network connection is blocked.

Not selected

Even if a malware infection is detected, the device's network connection will not be blocked.

Selected

Notify the device user with a warning message

Select this option to notify the user of the device with a warning message when the network connection of the device infected with malware is blocked.

Selected

Notifies the user of the device with a warning message.

Not selected

messages are not sent to device users.

Selected

Title

Sets the title of the warning message.

A character string of 256 or fewer characters

Notification of Network Connection Block

Message

Sets the body of the warning message.

A character string of 230,400 or fewer characters

Malware infection has been detected. We will block the network connection. Please handle it by displaying the screen under [Settings] - [Update & Security] - [Windows Security] - [Virus & threat protection]. After running a full virus scan and confirming there is no threat of malware infection, please contact the administrator.

Display duration

Set the duration in days to display the warning message.

1 to 30

7

Add notes to the device

This setting is set to add to the notes of the blocked device when the network connection of the device infected with malware is blocked.

Selected

Add to the device's notebook.

Not selected

It is not added to the device's notebook.

Selected

Set the contents to be added to the notebook of the blocked device.

A character string of 500 or fewer characters#

%date% system Network connection rejection due to malware detection

#: In "%date%", date is inserted in the format corresponding to Language of the system locale of JP1/IT Desktop Management 2 - Manager that blocked network connection.

Example:

In Japanese: 2024/10/18 GMT+09:00

In English: Oct/18/2024 GMT+09:00

In Cjinese: 2024-10-18 GMT+09:00

MDM server information (GWS integration)

The following table describes the parameters on the following screens:

Add MDM server information (GWS integration) window displayed when you click the Add GWS Integration button on the Connect to other systems - MDM Linkage Settings window on the settings window.

Edit MDM server information (GWS integration) window displayed when editing the MDM settings displayed in the list of "MDM System" - "Google Workspace" among the MDM settings displayed on the Connect to other systems - MDM Linkage Settings window on the settings window.

Item

Description

Specifiable values

Default

MDM settings name

Specifies name of the configuration.

A character string of 255 or fewer characters

(Blank)

GWS administrator user

Specify the ID (E-mail address) of the Google Workspace administrator user who is in the role of super administrator or service administrator.

Email character string

(Blank)

Secret key file

Specifies the private key file's file name. When Select is clicked, the Select the secret key file dialog box is displayed, and you can select the secret key file.

File with a file name of up to 100 characters

(Blank)

Import organization

Select the scope of Google Workspace organization to import.

Import from all organizations

Import from specified organizations

Import from all organizations

If you select "Import from specified organizations", specify the organization to be imported.

A character string of 0 to 512 ASCII characters that does not include control characters

/

Organization integration

Select whether to link your Google Workspace organization with JP1/IT Desktop Management 2.

Do not integrate

Integrate with department

Do not integrate

Refer to the "Proxy Server configuration" table above for Use Proxy Server, and the "Collection Schedule" table above for Collection Schedule.

(22) JP1/NETM/NM - Manager linkage parameters

The following table lists and describes the parameters in the JP1/NETM/NM - Manager Link Settings view displayed by clicking Edit for JP1/NETM/NM - Manager Link Settings in the Network Filter Settings view via the Network Access Control view of the Settings module.

Item

Description

Specifiable values

Default

Link with JP1/NETM/NM - Manager

Specify whether to link with JP1/NETM/NM - Manager.

Selected

The system links with JP1/NETM/NM - Manager.

Not selected

The system does not link with JP1/NETM/NM - Manager.

Not selected

(23) Parameters for device maintenance settings

The tables below list and describe the parameters in the Device Maintenance Settings and Detection Results view that opens from Inventory in the Settings module.

Detection conditions for device maintenance (for duplicate devices)

Detection conditions for duplicated devices

Item

Description

Specifiable values

Default

Detection condition name

Specify the name of the detection condition.

Character string with 256 or fewer characters

(Blank)

Detection target

Specify the types of the devices to be detected as duplicated devices.

Specify one or more of the following types:

Agent Management (Windows/Mac OS)

Agent Management (UNIX)

Agentless Management

MDM linkage management

API management

All types are selected.

Duplication conditions

Specify whether a device is to be detected as a duplicated device if a condition is met.

Specify one or more of the items below. If you specify multiple items, they are are joined by AND conditions.

IP address

Host name

You can specify whether the conditions are case-sensitive.

MAC address

BIOS serial number

None of the items are selected.

Time Since Last Connected

For devices that meet the duplication conditions and are of a type that is subject to detection, specify how many days a device needs to be disconnected from the management server for it to be detected as a duplicated device.

1 day to 999 days

7 days

Automatic deletion setting

Item

Description

Specifiable values

Default

Among a detected set of duplicate devices, automatically delete those devices whose last alive confirmation date/time is not the most recent

Specify whether to automatically delete devices that are detected as duplicate devices.

Selected

Automatically delete.

Not selected

Do not automatically delete.

Not selected

Period until automatic deletion

Specify the period (days) that the devices are kept before they are automatically deleted.

1 day to 999 days

14 days

Detection conditions for device maintenance (for idle devices)

Detection conditions for idle devices

Item

Description

Specifiable values

Default

Detection condition name

Specify the name of the detection condition.

Character string with 256 or fewer characters

(Blank)

Detection target

Specify the type of the device to be detected as idle devices.

Specify more than one of the following types:

Agent Management (Windows)

Agent Management (UNIX/Mac OS)

Agentless Management

MDM linkage management

API management

All of the types are selected.

Time Since Last Connected

For devices that are of a type that is subject to detection, specify how many days a device needs to be disconnected from the management server for it to be detected as an idle device.

1 day to 999 days

30 days

Automatic deletion setting

Item

Description

Specifiable values

Default

Automatically delete all detected idle devices

Specify whether to automatically delete the devices that are detected as idle devices.

Selected

Automatically delete.

Not selected

Do not automatically delete.

Not selected

Period until automatic deletion

Specify the period (days) that the devices are kept before they are automatically deleted.

1 day to 999 days

14 days

(24) Parameters for asset status settings of hardware assets associated with deleted devices

The following table lists and describes the Asset Status Settings of Hardware Assets Associated with Deleted Devices view that opens from Assets of the Settings module.

Item

Description

Specifiable values

Default

Change the asset status of hardware assets associated with deleted devices

Specify whether to change the asset status of the hardware assets associated with the deleted devices.

Selected

Change the asset status.

Not selected

Do not change the asset status.

Not selected

Asset Status

Select the asset status after the change.

Disposed

Asset status arbitrarily added by the user

Disposed

A.5 Lists of properties

The following table lists and describes the properties that can be set by the configuration file. Note that the settings in the configuration file are applied after the JP1/IT Desktop Management 2 service is restarted.

Property

Description

Setting value

Default

Capacity_OplogDBPathWarningThreshold

Warning threshold of the free space of the operation log database folder

0 to 1,048,576 MB

10% of Required Capacity of the operation log database

Capacity_OplogDBPathErrorThreshold

Error threshold of the free space of the operation log database folder

0 to 1,048,576 MB

3% of Required Capacity of the operation log database

Capacity_OplogBKPathWarningThreshold

Warning threshold of the free space of the operation log storage folder (when periodic export is disabled)

0 to 1,048,576 MB

The seven days total of the guideline values of the disk space required for the operation log storage folder

Capacity_OplogBKPathErrorThreshold

Error threshold of the free space of the operation log storage folder (when periodic export is disabled)

0 to 1,048,576 MB

The three days total of the guideline values of the disk space required for the operation log storage folder

Capacity_OplogBKPathWarningThreshold_ExportEnabled

Warning threshold of the free space of the operation log storage folder (when periodic export is enabled)

0 to 1,048,576 MB

The seven days total of the guideline values of the disk space required for the operation log storage folder

Capacity_OplogBKPathErrorThreshold_ExportEnabled

Error threshold of the free space of the operation log storage folder (when periodic export is enabled)

0 to 1,048,576 MB

The three days total of the guideline values of the disk space required for the operation log storage folder

Capacity_DataPathWarningThreshold_OpLogEnabled_ExportDisabled

Warning threshold of the free space of the data folder (when operation log is enabled and periodic export is disabled)

0 to 1,048,576 MB

50% of the guideline value of the disk space required for the data folder used as the operation log buffer + 3,072 MB

Capacity_DataPathErrorThreshold_OpLogEnabled_ExportDisabled

Error threshold of the free space of the data folder (when operation log is enabled and periodic export is disabled)

0 to 1,048,576 MB

30% of the guideline value of the disk space required for the data folder used as the operation log buffer + 500

Capacity_DataPathWarningThreshold_OpLogEnabled_ExportEnabled

Warning threshold of the free space of the data folder (when operation log is enabled and periodic export is enabled)

0 to 1,048,576 MB

50% of the guideline value of the disk space required for the data folder used as the operation log buffer + 3,072 MB

Capacity_DataPathErrorThreshold_OpLogEnabled_ExportEnabled

Error threshold of the free space of the data folder (when operation log is enabled and periodic export is enabled)

0 to 1,048,576 MB

30% of the guideline value of the disk space required for the data folder used as the operation log buffer + 500

State_AfterAgentUninstalling#1

Specifies whether uninstallation of JP1/IT Desktop Management 2 - Agent is treated as disposal of a device, or as uninstallation of JP1/IT Desktop Management 2 - Agent.

0: Treated as an uninstallation.

1: Treated as disposal of a device.

0

Report_Data_MakeTime

Time for creating totalization data for the report

00:00 to 23:59

23:00

Report_Digest_MakeTime

Time for creating a digest report

00:00 to 23:59

06:00

DB_MentenanceTime

Time for database maintenance

00:00 to 23:59

05:00

ChangeHistory_GetTime

Time for acquiring the revision history

00:00 to 23:59

00:00

OpLog_DB_DeleteTime

Time for maintenance of the operation log database in which operation logs were automatically acquired

00:00 to 23:59

01:00

UNIX_Software_Manage

Specifies whether the software information in an agent for UNIX or Mac is managed.

YES: Managed.

NO: Not managed.

NO

DeviceAutoMaintenanceTime

Time for starting maintenance processing if device maintenance is enabled

00:00 to 23:59

23:00

AgentStartMenu_Display

Settings for the display of start menu items for an agent due to distribution of Agent Installer and agents

ON: All start menu items for the agent are displayed.

OFF: None of the start menu items for the agent are displayed.#2

SELECT:xxx,xxx,... : Select the start menu items to be displayed.

The following lists the menu items that can be specified for xxx. To specify multiple menu items, separate them by using commas (,).

IDR: Register ID

UINF: End User Form

PSM: Package Setup Manager

RCCHAT: Remote Control Agent - Taskbar appearance

RCREQ: Remote Control Agent - Requester Wizard

RCAGT: Remote Control Agent - Remote Control Agent

ATAIT: Administrator Tool - Automatic Installation Tool

ATUSB: Administrator Tool - Register USB Device

ATSET: Administrator Tool - Setup

ATPACK: Administrator Tool - Packager

ATSEND: Administrator Tool - Send Inventory

For example, if you want to display Package Setup Manager and Register USB Device, specify the following:

SELECT:PSM,ATUSB

None

SDM_Mapping_Name

Specify whether to map the smart device name registered in JP1/IT Desktop Management 2 - Smart Device Manager as the host name, computer name, or device name displayed in the operation window of JP1/IT Desktop Management 2.

0: Do not map#3

1: Map

1

OfflineRegistration_StatusUnknown

Specifies the device status to be set for a computer that is managed offline when its device information is acquired for the first time.

ON: Changes the device status to Unknown.

OFF: Changes the device status to Stop.

Note that, if the device status is Warning, Warning will be displayed.

OFF

Mgrsrv_jdnmssecurityctrl

Setting for security judgment

10

This property must be set when the number of managed computers is 30,000 to 50,000.

5

Mgrsrv_Patch_AutoPackageKind

Set whether to automatically acquire update program or not

0: do not automatically acquire update program

1: automatically acquire update program

1

RollUpPatch_ExpirationDate

Expiration date for a monthly rollup judgment.

The security judgment for a monthly rollup is no longer made after the specified date. The specified value is interpreted as a date in the Eastern Standard Time in US.

Specify 0 or a value in the format: nth-week,day-of-week. nth-week can be 1 to 5. day-of-week can be 1 to 7. The day-of-week value represents:

1: Sunday

2: Monday

3: Tuesday

4: Wednesday

5: Thursday

6: Friday

7: Saturday

When 0 is specified, no expiration date is set on the judgment.

2, 3

(Second Tuesday)

RestAPIProtocol

Setting for the communication protocol using the API

0: HTTP protocol

1: HTTPS protocol

0

RestAPIInventoryUpdatePriorityLow

Setting that specifies the priority for updating the device information collected via the API

Select one of the following methods so that the priority for updating the device information collected via the API is set to be one level higher than the priority for updating the device information collected by the specified method:

Shares: Device information collected via a Windows administrative share

SNMP: Device information collected by SNMP

AD: Device information collected from Active Directory

MDM: Device information collected by MDM linkage

ARP: Device information collected by ARP

If you do not specify this property, the priority for updating the device information collected via the API is set to priority 3 as described in (14) Updating device information.

SNMP

OpLog_ExportSourceDateAndTime

Specifies whether to additionally output the operation date and time (agent), operation date and time (UTC), and time zone of the source agent when the operation logs are exported.

NO: The operation date and time of the agent are output with the time zone of the management server.

YES: Additional information on when the operation logs of the agent were collected (Operation Date/Time (Agent), Operation Date/Time (UTC), and Time Zone) is output.

NO

Mgrsrv_jdnmssecurityctrl_L#4

Specifies the number of processes that perform security judgment.

1 to 20

10

Security_Judgement_Execution_Opportunity_L#4

Execution timing for the security judgment when the large-scale management option is enabled.

If this is set to ALL, the security judgment is executed when data related to the security judgment is updated. However, this increases the load on the server CPU, and may slow down the registration of device information collected from agents and the like or operations on the management window.

For details about tuning the settings for collecting device information, see the manual JP1/IT Desktop Management 2 Administration Guide.

SCH: During scheduled judgments

ALL: When data related to the security judgment is updated

SCH

Inventory_DBUpdate_Performance_Mode#5

Improve the DB performance for updating the device information.

When enabled, the property helps reduce the time before a USB device is displayed in the management window when registered, because the information on the device is handled preferentially over device information collected from agent, agentless, API-controlled, and other devices. It can also save time before the device information mentioned above is registered in JP1/IT Desktop Management 2 and the security judgment is performed.

0: Disable

1: Enable

0

Event_Deterrence_EventNumber_L#4

Specifies the event number for suppressing event output.

Specify the event numbers of events to suppress event output for, separated by commas. Leave this value blank if you do not want to suppress event output.

If suppressing event output for event number 1129:

Event_Deterrence_EventNumber=1129

If not suppressing event output:

Event_Deterrence_EventNumber=

1129 or blank

1129

Event_Deterrence_EventNumber#5

Specifies the event number for suppressing event output.

Specify the event numbers of events to suppress event output for, separated by commas. Leave this value blank if you do not want to suppress event output.

If suppressing event output for event number 1129:

Event_Deterrence_EventNumber=1129

If not suppressing event output:

Event_Deterrence_EventNumber=

1129 or blank

None

Software_Licenses_Totalization_Method

Setting of timing for the compilation of software license information.

This property sets the timing for the compilation of software license information executed when inventory information about the installed software is notified from managed devices.

For a management server, the more managed devices there are, the slower installed software information is reflected for devices. Furthermore, as the number of software licenses in use is compiled after the device installed software information is updated, the number will be inaccurate for a time.

Notes:

If you specified SCH for this property, it may take up to three minutes after the device installed software is reflected on the window until the compilation result is reflected.

EACH: Executes the compilation of software license information each time device information is updated.

SCH: Executes the compilation of software license information every three minutes.

EACH

Asset_HardwareInfo_RestKind

Specifies whether to update the hardware asset information when the device information is updated with the collected information

0: Update regardless of device type

1: Do not update when the device type is Unknown

0

ExcludeNetworkGroup#6

Settings to suppress the network group automatic generation

32

Other values cannot be specified.

None

AbortDeviceIdentify#7

Settings that do not perform identification when registering devices

Specify one or more MAC addresses

The MAC address is specified by 17 characters, including separators. Alphabetic characters are not case sensitive. The separator for the MAC address specifies ":" or "-".

If you specify more than one MAC address, separate the items by commas (,). For example, if you specify 00:05:9a:3c:7a:00 and 00:09:0f:fe:00:01, specify the following:

00:05:9a:3c:7a:00,00:09:0f:fe:00:01

The maximum number of MAC addresses that can be specified is 30.

None

DisableNCListUpdate#8

Settings to suppress automatic update of network control list

Specify one or more MAC addresses

Specify one or a combination of the following:

Duplicate MAC addresses on multiple devices

The MAC address is specified by 17 characters, including separators.

Random MAC Address

Specifies a random MAC address and a forward match of up to 17 characters.

Alphabetic characters are not case sensitive. The separator for the MAC address specifies ":" or "-".

If you specify more than one MAC address, separate the items by commas (,). For example, if you specify 00:05:9a:3c:7a:00 and 00:09:0f:fe:00:01, specify the following:

00:05:9a:3c:7a:00,00:09:0f:fe:00:01

Forward matches are specified, including "$". For example, if you want the first "02:05:", to specify a matching MAC address, specify the following:

02:05:$

The maximum number of MAC addresses that can be specified is 100.

None

NetworkControlListWarningThreshold

Alert threshold of the Network Control List

0 to 262140

162140

NetworkControlListNoticeOption

Set whether to notify notification items on the home screen when the number of network control list registrations reaches the warning threshold and the limit is reached

ON: Notify

OFF: Not notify

ON

OpLog_Export_AddIPAddressColumn

Settings whether to add IP address columns when exporting operation log

OFF: Disable

ON: Enable

OFF

Intune_Import_Software_Source#9

Setting the destination for installing software information when managing Agent-installed managed PCs in conjunction with Microsoft Intune

Agent: Collect installation software information obtained from the Agent

Intune: Collect installation software information from Microsoft Intune

Agent

#1

If no uninstallation notification can be received from an agent, the device information is not changed as is done in older versions. In such a case, take actions as necessary (for example, by deleting the device information). For devices for which Network Monitor is enabled, the device inventory is not deleted. After disabling Network Monitor, you need to delete the device inventory manually.

#2

In the case of the Citrix XenApp and Microsoft RDS server, specify all the start menus not to be displayed because displaying of the start menus of agents is not supported.

#3

If 0 is specified, the JP1/IT Desktop Management 2 operation window displays the following information as the host name, computer name, and device name: a combination of the user name, phone number, and model name in the smart-device information obtained from JP1/IT Desktop Management 2 - Smart Device Manager, separated with colons (for example, BobBrown:09012345678:iPhone).

#4

This is enabled only if you enabled the large-scale management option when installing the management server.

#5

This is enabled only if you disabled the large-scale management option when installing the management server.

#6

Does not create a network group when the subnet mask information is signaled by 255.255.255.255, and prevents the state of increasing the number of network groups. If the device does not belong to any network group, it belongs to the "Unknown" group.

#7

Specify duplicate MAC addresses on multiple devices. If the MAC address notified by the device matches one of the MAC addresses specified in the setting value, the device will not be identified.

#8

If the MAC address notified by the device matches one of the MAC addresses specified in the setting value, the network control list will not be updated.

#9

If Intune_Import_Software_Source setting is changed from "Intune" to "Agent", filter and display devices with agent-managed management type in the device list on the device window and then execute [Update Device Details] from [Action Menu]. The device's installation software switches to information obtained from Agent.

A.6 Performance and Estimates

This section describes memory requirements, disk space requirements, prerequisite CPUs, and performance for each system component of the product.

Related Topics:

(1) Memory requirements

(2) Disk space requirements

(3) Prerequisite CPUs

(4) Performance

(1) Memory requirements

The following describes the memory requirements for each system component of the product.

Management server

Management relay server

Computer that displays operation windows

Administrator's computer with Remote Install Manager installed

Administrator's computer with a remote control controller installed

Computer used as a relay system

Managed computer

Computer used as an internet gateway

Management server

Item

Operating environment

Memory usage

When the number of managed computers is 10,000 or fewer:#1#3#4

10 GB

When the number of managed computers is 10,000 to 30,000:#1#3#4

34 GB

When the number of managed computers is 30,000 to 50,000:#2#3#4

36 GB

When the number of managed computers is 50,000 to 100,000:#2#3#4

47 GB

When the number of managed computers is 100,000 to 300,000:#2#3#4

61 GB

Installed memory

An amount of installed memory equal to or greater than the sum of the following values is required in addition to the recommended memory size for each OS.

When the number of managed computers is 5,000 or fewer#1:

2 GB or more

When the number of managed computers is 5,000 to 10,000#1:

Minimum value

2 GB

Recommended value

8 GB or more

When the number of managed computers is 10,000 to 30,000#1:

Minimum value

16 GB

Recommended value

32 GB or more

When the number of managed computers is 30,000 to 50,000:

Minimum value

24 GB

Recommended value

40 GB or more

When the number of managed computers is 50,000 to 100,000:

Minimum value

32 GB

Recommended value

48 GB

When the number of managed computers is 100,000 to 300,000:

Minimum value

48 GB

Recommended value

64 GB

#1 If you specified a value for Capacity to be added to the cache during management server setup to improve the performance of the operation log search function, the specified value (a maximum of 16 GB) must be added.

#2 If there are 30,000 or more managed computers, with 10 to 20 users simultaneously manipulating the operation windows, use an additional 1,200 MB of memory.

#3 When you acquire HIBUN logs, an additional 500 MB of memory is used.

#4 When you use the API, an additional 1,600 MB of memory is used.

Management relay server

Item

Operating environment

Memory usage

When the number of managed computers is 10,000 or fewer:#1, #2

10 GB

When the number of managed computers is 10,000 to 30,000:#1, #2

32 GB

If you specified a value for Capacity to be added to the cache during management server setup to improve the performance of the operation log search function, the specified value (a maximum of 16 GB) must be added.

Installed memory

An amount of installed memory equal to or greater than the sum of the following values is required in addition to the recommended memory size for each OS:

When the number of managed computers is 5,000 or fewer:

2 GB or more

When the number of managed computers is 5,000 to 10,000:

Minimum value

2 GB

Recommended value

8 GB or more

When the number of managed computers is 10,000 to 30,000:

Minimum value

16 GB

Recommended value

32 GB or more

If you specified a value for Capacity to be added to the cache during management server setup to improve the performance of the operation log search function, the specified value (a maximum of 16 GB) must be added.

#1 When you acquire HIBUN logs, an additional 500 MB of memory is used.

#2 When you use the API, an additional 1,600 MB of memory is used.

Computer that displays operation windows

Item

Operating environment

Installed memory

2.0 GB or more

Administrator's computer with Remote Install Manager installed

Item

Operating environment

Memory usage

The required value can be calculated from the following formula:

20 + 0.002 x a MB

a: number of displayed data items

The number of displayed data items is the total of the data items (shown below) that are displayed in Remote Install Manager windows. If you want to display more than one of the same windows, multiply the number of data items by the number of those windows.

System Configuration window

Host information (management relay server, relay system, agent)

System information for each system

Installed packages for each agent

Destination window

ID (new host, asset management item condition)

Destination corresponding to each grouping information set (path, agent)

Host group (IP address, new host, OS type, additional management item of hardware asset information, department, installation location)

Destination corresponding to each grouping information set (path, agent)

Installed packages for each agent

Job Definition window

Folders, Job Definition

Package window

Cabinet, Package

Job Status window

Folder, Job (destination for each job, package for each job)

List of Software Information window

Search list

Installed memory

2.0 GB or more

Administrator's computer with a remote control controller installed

Item

Operating environment

Memory usage

The sum of the following values:

Basic function (remote control): (10 x number of connections) MB

File transfer function: 4 MB

Chat server function: (4 + (0.2 x number of connections)) MB

Chat client function: (4 + (0.4 x number of connections)) MB

Installed memory

An amount of installed memory equal to or greater than the sum of the following values is required:

Recommended memory size for each OS

Memory usage multiplied by 0.5 and then truncated to the nearest multiple of 8

Computer used as a relay system

Item

Operating environment

Memory usage

The sum of the following values:

Basic functions (device information collection, distribution, and remote control) (always resident): 58 MB

Operation logging function (resident when the function is enabled): 34 MB for a 32-bit OS, or 43 MB for a 64-bit OS

Network monitor function (resident when the function is enabled): 2 MB + (10 x number of network segments to be monitored) MB

The value calculated from the following formula:

28 + 0.018 x (a + 8) + (b x 0.001)

a: Number of concurrently connected computers

The value specified for Number of JP1/IT Desktop Management 2 - Agents that can be connected to the relay system concurrently under Processing settings for the relay system in the window displayed from Relay system settings of the agent configurations

b: Cache size of the management file

Calculate the value by using the following formula:

Cache size of the management file (KB) = number of jobs that are saved in the relay system and executed by the higher system x number of destinations for each job x number of packages for each job (for remote installation jobs) x 1 KB

Installed memory

An amount of installed memory equal to or greater than the sum of the following values is required:

Recommended memory size for each OS

Memory usage multiplied by 0.5, and then truncated to the nearest multiple of 8

Managed computer

Item

Operating environment

Memory usage

Computer with an agent installed

The sum of the following values:

Basic functions (device information collection, distribution, and remote control) (always resident): 58 MB

Operation logging function (resident when the function is enabled): 34 MB for a 32-bit OS, or 43 MB for a 64-bit OS

If you are using the operation logging function in a Citrix XenApp and Microsoft RDS environment, 45 MB of memory must be added per user who logs in to the Citrix XenApp and Microsoft RDS environment.

Network monitor function (resident when the function is enabled): 2 MB + (10 x number of network segments to be monitored) MB

Agentless computer

22 MB

Installed memory#

An amount of installed memory equal to or greater than the sum of the following values is required:

For agent-installed computers:

Recommended memory size for each OS

Memory usage multiplied by 0.5, and then truncated to the nearest multiple of 8

For agent-less computers:

Recommended memory size for each OS + 16 MB

#: The value given here is the minimum specifications for the OS. For comfortable operation, sufficient specifications including the resource to be used by other programs running on the target device is required.

Computer used as an internet gateway

Item

Operating environment

Memory usage

The sum of the following values:

2.0 GB

Memory usage of a relay system

Installed memory

An amount of installed memory equal to or greater than the sum of the following values is required:

Recommended memory size for each OS

2.0 GB

Installed memory of a relay system

Note: If you want to use a distribution using Remote Install Manager, install the relay system on the computer of the internet gateway.

(2) Disk space requirements

The following describes the disk space requirements for each system component of the product.

Management server

Management relay server

Computer that displays operation windows

Administrator's computer with Remote Install Manager installed

Administrator's computer with a remote control controller installed

Computer used as a relay system

Managed computer

Computer on which Packager is installed

Computer on which Automatic Installation Tool is installed

Computer on which the Internet gateway is installed

Management server

Item

Operating environment

Installation drive (program size)

When the number of managed computers is 10,000 or fewer:#6

2.5 GB or more

When the number of managed computers is 10,000 to 30,000:#6

17.5 GB or more

When the number of managed computers is 30,000 to 50,000:#7

17.5 GB or more

When the number of managed computers is 50,000 to 100,000:#7

20.5 GB or more

When the number of managed computers is 100,000 to 300,000:#7

32.5 GB or more

If you added the capacity of the database cache to improve the performance of the operation log search function, the value specified for addition (a maximum of 16 GB) must be added.

Drive of the database storage folder

When the number of managed computers is 10,000 or fewer:

The required space is equal to or greater than the sum of the following values:

Basic function: 20 GB

Revision history function: Data capacity appropriate for the operation#2

When the number of managed computers is 10,000 to 30,000:

The required space is equal to or greater than the sum of the following values:

Basic function: 60 GB

Revision history function: Data capacity appropriate for the operation#2

When the number of managed computers is 30,000 to 50,000:

A value equal to or greater than the sum of the following values:

Basic function: 120 GB

Revision history function: Data capacity appropriate for the operation#2

When the number of managed computers is 50,000 to 100,000:

A value equal to or greater than the sum of the following values:

Basic function: 240 GB

Revision history function: Data capacity appropriate for the operation#2

When the number of managed computers is 100,000 to 300,000:

A value equal to or greater than the sum of the following values:

Basic function: 600 GB

Revision history function: Data capacity appropriate for the operation#2

Drive for the operation log database folder

You must estimate the data capacity#1 appropriate for the operation.

Drive on which the data folder is stored

A value equal to or greater than the sum of the following values:

Basic functions: 320 MB

The sum of the sizes of all distribution packages

Automatically distributed program update files of security measures are included in (The sum of the sizes of all distribution packages)

The sum of the sizes of attached files for hardware assets, contracts, and licenses

The sum of the sizes of Agent Installer - Files to Be Deployed

The capacity required for operation logs

You must estimate the data capacity#3 appropriate for the operation. #7

Drive of the operation log backup folder

You must estimate the data capacity#4 appropriate for the operation. #7

Drive on which the revision history output folder is stored

You must estimate the data capacity#5 appropriate for the operation.

#1: For details about the data capacity required for the operation log database, see 4.5.4 Guidelines for disk space requirements for the operation log database. If the number of managed computers is in the range from 10,000 or more, Hitachi recommends that you use a dedicated physical disk for the operation log database.

#2: For details about the data capacity required for the revision history database, see 4.5.7 Guidelines for disk space requirements for revision history database.

#3: For details about the data capacity required for the data folder, see 4.5.5 Guidelines for disk space requirements in the data folder for acquiring operation logs.

#4: For details about the data capacity required for the operation log storage folder, see 4.5.3 Guidelines for disk space requirements for operation log backup folder.

#5: For details about the data capacity required for the revision history output folder, see 4.5.6 Guidelines for disk space requirements for revision history archive.

#6: If you added the capacity of the database cache to improve the performance of the operation log search function, the value specified for addition (a maximum of 16 GB) must be added.

#7: When the number of managed computers is 30,000 or more and you want to collect operation logs, you must use a multi-server configuration. Because the primary management server does not collect the information, the capacity for operation logs is not included in the estimate.

To use the distribution function, the following additional free disk space is required.

For distribution using Remote Install Manager

Item

Operating environment

Drive with JP1/IT Desktop Management 2 - Manager installed

1.0 x number of packages x number of agents + number of packages x 0.3 (KB)

Drive on which the data folder is stored

Total package size after compression + number of packages x 2 (KB)

For ITDM-compatible distribution

Item

Operating environment

Drive with JP1/IT Desktop Management 2 - Manager installed

Free disk space more than twice the package size (before compression)

Drive on which the data folder is stored

System drive

Free disk space for the package (before compression)

To automatically update the component, the following additional free disk space is required.

Item

Operating environment

Drive with JP1/IT Desktop Management 2 - Manager installed

500 MB

Drive on which the data folder is stored

System drive

To use the API, the following additional free disk space is required.

Item

Operating environment

Drive with JP1/IT Desktop Management 2 - Manager installed

356 MB

Management relay server

Item

Operating environment

Installation drive (program size)

When the number of managed computers is 10,000 or fewer:

2.5 GB or more

When the number of managed computers is 10,000 to 30,000:

17.5 GB or more

If you added the capacity of the database cache to improve the performance of the operation log search function, the value specified for addition (a maximum of 16 GB) must be added.

Drive of the database storage folder

When the number of managed computers is 10,000 or fewer:

A value equal to or greater than the sum of the following values:

Basic function: 20 GB

Revision history function: Data capacity appropriate for the operation#2

When the number of managed computers is 10,000 to 30,000:

A value equal to or greater than the sum of the following values:

Basic function: 60 GB

Revision history function: Data capacity appropriate for the operation#2

Drive for the operation log database folder

You must estimate the data capacity#1 appropriate for the operation.

Drive on which the data folder is stored

A value equal to or greater than the sum of the following values:

Basic function: 24 MB

The sum of the sizes of all distribution packages

Automatically distributed program update files of security measures are included in (The sum of the sizes of all distribution packages)

The sum of the sizes of attached files for hardware assets, contracts, and licenses

The sum of the sizes of Agent Installer - Files to Be Deployed

The capacity required for operation logs

You must estimate the data capacity#3 appropriate for the operation.

Drive of the operation log storage folder

You must estimate the data capacity#4 appropriate for the operation.

Drive on which the revision history output folder is stored

You must estimate the data capacity#5 appropriate for the operation.

#1: For details about the data capacity required for the operation log database, see 4.5.4 Guidelines for disk space requirements for the operation log database. If the number of managed computers is in the range from 10,000 to 30,000, Hitachi recommends that you use a dedicated physical disk for the operation log database.

#2: For details about the data capacity required for the revision history database, see 4.5.7 Guidelines for disk space requirements for revision history database.

#3: For details about the data capacity required for the data folder, see 4.5.5 Guidelines for disk space requirements in the data folder for acquiring operation logs.

#4: For details about the data capacity required for the operation log storage folder, see 4.5.3 Guidelines for disk space requirements for operation log backup folder.

#5: For details about the data capacity required for the revision history output folder, see 4.5.6 Guidelines for disk space requirements for revision history archive.

To use the distribution function, additional free disk space is required as described below.

For distribution using Remote Install Manager

Item

Operating environment

Drive with JP1/IT Desktop Management 2 - Manager installed

1.0 x number of packages x number of agents + number of packages x 0.3 (KB)

Drive on which the data folder is stored

Total package size after compression + number of packages x 2 (KB)

For ITDM-compatible distribution

Item

Operating environment

Drive with JP1/IT Desktop Management 2 - Manager installed

Free disk space more than twice the package size (before compression)

Drive on which the data folder is stored

System drive

Free disk space for the package (before compression)

To use the API, the following additional free disk space is required.

Item

Operating environment

Drive with JP1/IT Desktop Management 2 - Manager installed

356 MB

Computer that displays operation windows

JP1/IT Desktop Management 2 does not require disk space.

Administrator's computer with Remote Install Manager installed

Item

Operating environment

Installation drive (program size)

24 MB or more

Administrator's computer with a remote control controller installed

Item

Operating environment

Installation drive (program size)

20 MB or more

Computer used as a relay system

Item

Operating environment

Installation drive (program size)

The required space is equal to or greater than the sum of the following values:

Basic functions (inventory collection, distribution, and remote control): 71 MB

Operation logging function: 120 MB

Network monitor function: 2 MB + (55 x number of network segments to be monitored) MB

If Remote Install Manager is used for distribution, the free space described in the following table is also required.

Item

Operating environment

Drive with a relay system installed

(80 + total package size after compression + number of packages x number of agents under the relay system / 1024) MB

If a relay system is updated by automatic update, the free space described in the following table is also required.

Item

Operating environment

Drive with a relay system installed

200 MB

Drive on which the data folder is stored

System drive of a computer with a relay system agent installed

Managed computer

Item

Operating environment

Installation drive (program size)

For agentless operation:

JP1/IT Desktop Management 2 does not require disk space.

For agent operation:

A value equal to or greater than the sum of the following values:

Basic functions (inventory collection, distribution, and remote control): 71 MB

Operation logging function: 120 MB + 260 KB x retention period (days)

If you are using the operation logging function in a Citrix XenApp and Microsoft RDS environment, the value is calculated from the following formula:

120 MB + 12 GB + 260 KB x retention period (days) x number of logged-in users

Network monitor function: 2 MB + (55 x number of network segments to be monitored) MB

To use the distribution function, the following additional free disk space is required.

For distribution using Remote Install Manager

Item

Operating environment

Drive with an agent installed

Free disk space more than three times the package size (before compression)

For ITDM-compatible distribution

Item

Operating environment

Drive with an agent installed

When the package type is Software Installation: Free disk space more than twice the package size (before compression to a ZIP file)

When the package type is File Distribution: Free disk space more than triple the package size (before compression to a ZIP file)

System drive of a computer with an agent installed

Free disk space for the package (before compression to a ZIP file)

To update an agent automatically, the following additional free disk space is required.

Item

Operating environment

Drive with an agent installed

50 MB

System drive of a computer with an agent installed

To update a network agent automatically, the following additional free disk space is required.

Item

Operating environment

Drive with an agent installed

20 MB

System drive of a computer with an agent installed

When an agentless computer uses Windows administrative shares for authentication, executable programs are sent to execute functions. At least 2.5 MB of free disk space is required to store the executable programs.

Computer on which a package is installed.

Item

Operating environment

Drive with an agent installed

7 MB + free disk space more than twice the package size (before compression)

Computer on which Automatic Installation Tool is installed

Item

Operating environment

Drive with an agent installed

6 MB

Computer on which the Internet gateway is installed

Item

Operating environment

Installation drive (program size)

A value equal to or greater than the sum of the following values:

25 MB

Disk usage of the relay system

Package size

Calculate the package size by using the following formula:

For distribution using Remote Install Manager:

100 x Split size of Package (split distribution)

For ITDM-compatible distribution:

9 GB

Note: If you want to use a distribution using Remote Install Manager, install the relay system on the computer of the internet gateway.

Related Topics:

4.5 Examining the database

(3) Prerequisite CPUs

This section describes the prerequisite CPUs for each system component of the product.

Management server

Computer that displays operation windows

Administrator's computer with Remote Install Manager installed

Administrator's computer with a remote control controller installed

Computer used as a relay system

Managed computer

Computer used as an internet gateway

Management server

When the number of managed computers is 5,000 or fewer:

A processor at 2.0 GHz or higher

When the number of managed computers is 5,000 to 10,000:

Minimum requirements

A processor at 2.0 GHz or higher

Recommended requirements

A 4-core processor at 2.0 GHz or higher

When the number of managed computers is 10,000 to 30,000:

Minimum requirements

Intel Xeon (4-core) processor at 2.5 GHz or higher x 2

Recommended requirements

Intel Xeon (4-core) processor at 3.0 GHz or higher x 2

When the number of managed computers is 30,000 to 50,000:

Minimum requirements

Intel Xeon (8-core) processor at 2.5 GHz or higher x 2

Recommended requirements

Intel Xeon (10-core) processor at 3.0 GHz or higher x 2

When the number of managed computers is 50,000 to 100,000:

Minimum requirements

Intel Xeon (10-core) processor at 2.5 GHz or higher x 2

Recommended requirements

Intel Xeon (12-core) processor at 3.0 GHz or higher x 2

When the number of managed computers is 100,000 to 300,000:

Minimum requirements

Intel Xeon (16-core) processor at 2.5 GHz or higher x 2

Recommended requirements

Intel Xeon (18-core) processor at 3.0 GHz or higher x 2

Computer that displays operation windows

A CPU which corresponds to either of the following is assumed:

A hyper-threading technology processor equivalent to Intel Pentium 4 or higher

A processor equivalent to Intel Core 2 or higher

Administrator's computer with Remote Install Manager installed

Minimum requirements

A processor at 1 GHz

Recommended requirements

A processor at 2 GHz or higher

Administrator's computer with a remote control controller installed

Computer OS

Operating environment

Windows Server 2019

A 64-bit processor at 1.4 GHz or higher

Windows Server 2016

A 64-bit processor at 1.4 GHz or higher

Windows 10

A 32-bit or 64-bit processor at 1.0 GHz or higher

Windows 8.1

A 32-bit or 64-bit processor at 1.0 GHz or higher

Windows 8

A 32-bit or 64-bit processor at 1.0 GHz or higher

Windows Server 2012

A 64-bit processor at 1.4 GHz or higher

Windows 7

A 32-bit or 64-bit processor at 1.0 GHz or higher

Windows Server 2008 R2

A 64-bit processor at 1.4 GHz or higher

Computer used as a relay system

Computer OS

Operating environment

Windows Server 2019

A 64-bit processor at 1.4 GHz or higher

Windows Server 2016

A 64-bit processor at 1.4 GHz or higher

Windows 10

A 32-bit or 64-bit processor at 1.0 GHz or higher

Windows 8.1

A 32-bit or 64-bit processor at 1.0 GHz or higher

Windows 8

A 32-bit or 64-bit processor at 1.0 GHz or higher

Windows Server 2012

A 64-bit processor at 1.4 GHz or higher

Windows 7

A 32-bit or 64-bit processor at 1.0 GHz or higher

Managed computers

Agentless computers

No restrictions on CPUs.

Computers on which agents will be installed#

Computer OS

Operating environment

Windows Server 2019

A 64-bit processor at 1.4 GHz or higher

Windows Server 2016

A 64-bit processor at 1.4 GHz or higher

Windows 10

A 32-bit or 64-bit processor at 1.0 GHz or higher

Windows 8.1

A 32-bit or 64-bit processor at 1.0 GHz or higher

Windows 8

A 32-bit or 64-bit processor at 1.0 GHz or higher

Windows Server 2012

A 64-bit processor at 1.4 GHz or higher

Windows 7

A 32-bit or 64-bit processor at 1.0 GHz or higher

Windows Server 2008 R2

A 64-bit processor at 1.4 GHz or higher

#: The value given here is the minimum specifications for the OS. For comfortable operation, sufficient specifications including the resource to be used by other programs running on the target device is required,

Computer on which the network monitor is enabled

Computer OS

Operating environment

Windows Server 2019

A 64-bit processor at 1.4 GHz or higher

Windows Server 2016

A 64-bit processor at 1.4 GHz or higher

Windows 10

A 32-bit or 64-bit processor at 1.0 GHz or higher

Windows 8.1

A 32-bit or 64-bit processor at 1.0 GHz or higher

Windows 8

A 32-bit or 64-bit processor at 1.0 GHz or higher

Windows Server 2012

A 64-bit processor at 1.4 GHz or higher

Windows 7

A 32-bit or 64-bit processor at 1.0 GHz or higher

Computer used as an internet gateway

Minimum requirements

Intel Xeon (4-core) processor at 2.5 GHz or higher x 2

Recommended requirements

Intel Xeon (4-core) processor at 3.0 GHz or higher x 2

(4) Performance

The following describes the performance of the management server.

Device information collected from agent or agentless devices is sequentially loaded into the management server. While it may take some time to load when the collection of device information occurs at the same time, the device information for a day will be loaded within that same day.

A.7 List of limit values

For some items that can be managed by JP1/IT Desktop Management 2, there are restrictions on the number of items that can be registered and on the specifiable values. The tables below show the limit values for each item. The tables below use the following legend.

Legend: --: Not applicable

Login window

Function

Item

Limit value

Default

Description

Login

Number of users who can log in concurrently

There is no upper limit.

--

The assumed maximum numbers are as follows:

When the number of managed computers is 30,000 or fewer: 20 users

When the number of managed computers is 30,000 to 50,000: 20 users

When the number of managed computers is 50,000 to 100,000: 20 users

When the number of managed computers is 100,000 to 300,000: 20 users

Security module

Function

Item

Limit value

Default

Description

Security Policy

Security Policy

There is no upper limit.

2 items

By default, Default policy and Recommended security policy are registered.

When the number of managed computers is 30,000 or fewer, the assumed maximum number of items that can be registered is 140, including the default security policies.

When the number of managed computers is 30,000 to 50,000, the assumed maximum number of items that can be registered is 200, including the default security policies.

When the number of managed computers is 50,000 to 100,000, the assumed maximum number of items that can be registered is 200, including the default security policies.

When the number of managed computers is 100,000 to 300,000, the assumed maximum number of items that can be registered is 200, including the default security policies.

Security Configuration Items for Security Policy

Mandatory Software

There is no upper limit.

0 item

The assumed maximum number of items that can be registered is 100, including those registered for Unauthorized Software.

Unauthorized Software

There is no upper limit.

0 item

The assumed maximum number of items that can be registered is 100, including those registered for Mandatory Software.

Unauthorized Windows Service

There is no upper limit.

0 item

The assumed maximum number of items that can be registered is 30.

User-defined security settings in user definitions

There is no upper limit.

0 item

The assumed maximum number of items that can be registered is 30.

Blocked Software

There is no upper limit.

0 item

The assumed maximum number of items that can be registered is 100, including those registered for Mandatory Software.

Windows Update

Number of displayed items

There is no upper limit.

0

--

Programs that can be added to Windows Updates manually

There is no upper limit.

0 item

The assumed maximum number of items that can be registered is 1,000.

Computer Security Status

Windows updates not applied for one device

There is no upper limit.

--

The assumed maximum number of items that can be registered is 100.

Mandatory software not installed for one device

There is no upper limit.

--

The assumed maximum number of items that can be registered is 50.

Unauthorized software installed for one device

There is no upper limit.

--

The assumed maximum number of items that can be registered is 50.

Number of accounts that can be confirmed in the OS security settings for one device

1 to 50

--

--

Number of services that can be confirmed in the service security settings for one device

1 to 30

--

--

USB device information

Information about files collected from a USB device for one device

1 to 10,000 items

--

--

Operation Logs

Number of displayed items

There is no upper limit.

0

--

Note: Even for items that have no upper limit, registering a huge amount of information might affect performance. For example, search performance might be degraded.

Assets module

Function

Item

Limit value

Default

Description

Hardware Asset

Hardware Asset Information

There is no upper limit.

0 item

When the number of managed computers is 30,000 or fewer, the assumed maximum number of items that can be registered is 112,500. The number includes USB devices, whose assumed maximum number is 6,000.

When the number of managed computers is 30,000 to 50,000, the assumed maximum number of items that can be registered is 187,500. The number includes USB devices, whose assumed maximum number is 6,000.

When the number of managed computers is 50,000 to 100,000, the assumed maximum number of items that can be registered is 375,000. The number includes USB devices, whose assumed maximum number is 6,000.

When the number of managed computers is 100,000 to 300,000, the assumed maximum number of items that can be registered is 1,125,000. The number includes USB devices, whose assumed maximum number is 6,000.

Hardware Asset Information

Attached files

5

--

--

Asset Status

0 to 100 items can be added in addition to the default.

4 items

By default, Unconfirmed, In Stock, In Use, and Disposed are registered for Asset Status.

These items are the same as those of the Settings module.

Planned Asset Status

0 to 100 items can be added in addition to the default.

3 items

By default, In Stock, In Use, and Disposed are registered for Planned Asset Status.

These items are the same as those of Asset Status, except for Unconfirmed.

Device Type

0 to 100 items can be added in addition to the default.

11 items

By default, PC, Server, Storage, Network Device, Printer, Smart Device, Peripheral Device, USB Device, Display, Other, and Unknown are registered for Device Type.

These items are the same as those of the Settings module.

Number of items for Export Columns

1 to 200

8 items

By default, Device Type, Asset #, Device Name, Manufacturer, Asset Status, Planned Asset Status, Planned Date, and Last Tracked Date are selected for Export Columns.

Software License

Software License

There is no upper limit.

0 item

When the number of managed computers is 30,000 or fewer, the assumed maximum number of items that can be registered is 15,000.

When the number of managed computers is 30,000 to 50,000, the assumed maximum number of items that can be registered is 25,000.

When the number of managed computers is 50,000 to 100,000, the assumed maximum number of items that can be registered is 25,000.

When the number of managed computers is 100,000 to 300,000, the assumed maximum number of items that can be registered is 25,000.

Software License

Attached files

5

--

--

License Type

0 to 100 items can be added in addition to the default.

2 items

By default, Install License and Other are registered for License Type.

These items are the same as those of the Settings module.

License Status

0 to 100 items can be added in addition to the default.

2 items

By default, In Use and Expired are registered for License Status.

These items are the same as those of the Settings module.

Planned License Status

0 to 100 items can be added in addition to the default.

2 items

By default, In Use and Expired are registered for Planned License Status.

These items are the same as those of License Status.

Number of items for Export Columns

1 to 200

11 items

By default, the following items are selected for Export Columns: License #, License Name, License Type, Total Licenses, License Total, Assigned License Total, Remaining License Total, License Status, Planned License Status, Planned Date, Last Tracked Date.

Managed Software

Managed Software

There is no upper limit.

0 item

When the number of managed computers is 30,000 or fewer, the assumed maximum number of items that can be registered is 200.

When the number of managed computers is 30,000 to 50,000, the assumed maximum number of items that can be registered is 300.

When the number of managed computers is 50,000 to 100,000, the assumed maximum number of items that can be registered is 550.

When the number of managed computers is 100,000 to 300,000, the assumed maximum number of items that can be registered is 1,550.

Number of items for Export Columns

1 to 11

7 items

By default, Managed Software Name, Manufacturer, License Type, License Total, Number of Used Licenses, and Remaining License Total are selected for Export Columns.

Contract

Contract Information

There is no upper limit.

0 item

When the number of managed computers is 30,000 or fewer, the assumed maximum number of items that can be registered is 26,250.

When the number of managed computers is 30,000 to 50,000, the assumed maximum number of items that can be registered is 43,750.

When the number of managed computers is 50,000 to 100,000, the assumed maximum number of items that can be registered is 62,500.

When the number of managed computers is 100,000 to 300,000, the assumed maximum number of items that can be registered is 137,500.

Contract Type

0 to 100 items can be added in addition to the default.

5 items

By default, Lease, Rent, Maintenance, and Support, Fixed are registered for Contract Type.

These items are the same as those of the Settings module.

Contract Vendor Name

There is no upper limit.

0 item

The assumed maximum number of items that can be registered is 60.

This item is the same as the item of the Settings module.

Contract Status

0 to 100 items can be added in addition to the default.

3 items

By default, Active, Canceled, and Expired are registered for Contract Status.

These items are the same as those of the Settings module.

Number of items for Export Columns

1 to 200

7 items

By default, Contract #, Contract Name, Contract Type, Contract Start Date, Contract End Date, Contract Date, and Contract Status are selected for Export Columns.

Other

Templates used for import and export

There is no upper limit.

--

When the number of managed computers is 30,000 or fewer, the assumed maximum number of items that can be registered is 120.

When the number of managed computers is 30,000 to 50,000, the assumed maximum number of items that can be registered is 200.

When the number of managed computers is 50,000 to 100,000, the assumed maximum number of items that can be registered is 400.

When the number of managed computers is 100,000 to 300,000, the assumed maximum number of items that can be registered is 1,200.

Note: Even for items that have no upper limit, registering a huge amount of information might affect performance. For example, search performance might be degraded.

Inventory module

Function

Item

Limit value

Default

Description

Device Information

Device Information

Number of purchased licenses

0

--

Installed software for one device

There is no upper limit.

--

The assumed maximum number of items that can be registered is 500.

Number of accounts for one device that can be confirmed in Account Details on the Service Details tab

1 to 60

--

--

Number of services for one device that can be confirmed in Windows Security Details on the Service Details tab

1 to 30

--

--

Export Device Details

Number of records to be exported from the management window

There is no upper limit.

--

The assumed maximum number of items that can be registered is 10,000.

Installed Software

There is no upper limit.

--

The assumed maximum number of items that can be registered is 10.

Installed Updates

There is no upper limit.

--

The assumed maximum number of items that can be registered is 10.

Revision history

Number of entries that can be displayed in the device revision history list

600,000 entries

--

--

Software Inventory

Software

Number of software records that can be collected

0

When the number of managed computers is 30,000 or fewer, the assumed maximum number of software records is 30,000.

When the number of managed computers is 30,000 to 50,000, the assumed maximum number of software records is 35,000.

When the number of managed computers is 50,000 to 100,000, the assumed maximum number of software records is 35,000.

When the number of managed computers is 100,000 to 300,000, the assumed maximum number of software records is 35,000.

Number of items for Export Columns

1 to 9

8 items

By default, Software Name, Version, Software Vendor, Installed Software Total, Registration Date/Time, Mandatory Software, Unauthorized Software, and Managed Software are selected for Export Columns.

Distribution (ITDM-compatible) module

Function

Item

Limit value

Default

Description

Packages

Packages

0 to 10,000 items

0

--

Number of archive files of ZIP files registered in packages

There is no upper limit.

--

The assumed maximum number of files that can be registered is 3,000.

Size of files registered in packages

1 GB or less

--

--

Total size of files extracted from ZIP files registered in packages

Less than 2 GB

--

--

Tasks

Tasks

0 to 10,000 items

0

--

Target Computers

Number of managed computers

0

--

Events module

Function

Item

Limit value

Default

Description

Events

Number of events that can be displayed

Number of managed computers x 250 + 10,000

0

--

Settings module

Function

Item

Limit value

Default

Description

User Management

Users

There is no upper limit.

1 item

When the number of managed computers is 30,000 or fewer, the assumed maximum number of items that can be registered is 150.

When the number of managed computers is 30,000 to 50,000, the assumed maximum number of items that can be registered is 213.

When the number of managed computers is 50,000 to 100,000, the assumed maximum number of items that can be registered is 423.

When the number of managed computers is 100,000 to 300,000, the assumed maximum number of items that can be registered is 1,263.

By default, a built-in account is registered.

Agent

Agent Configurations

There is no upper limit.

1 item

By default, the default agent configuration is registered.

Update Interval (Agentless Management)

24 hours

1 hour

--

Remote control settings

Allowed Controllers

256

--

--

Remote control settings

Allowed User List

256

--

--

Discovery

Discovered Nodes

There is no upper limit.

0 item

--

Managed Nodes

Number of purchased licenses

0 item

--

Ignored Nodes

There is no upper limit.

0 item

--

Network Access Control

Network Access Control Settings

There is no upper limit.

0 item

The assumed maximum number of records that can be registered is 10.

Exclusive Communication Destination for Access-Denied Devices

There is no upper limit.

0 item

The assumed maximum number of records that can be registered is 110.

Network Filter Settings

262,140

Network connection control is possible on up to 262,140 pieces of network information.

0 item

When the number of managed computers is 30,000 or fewer, the assumed maximum number of items that can be registered is 66,000.

When the number of managed computers is 30,000 to 50,000, the assumed maximum number of items that can be registered is 110,000.

When the number of managed computers is 50,000 to 100,000, the assumed maximum number of items that can be registered is 220,000.

When the number of managed computers is 100,000 to 300,000, the assumed maximum number of items that can be registered is 262,140.

Security Control

Windows OS version

There is no upper limit.

0 item

The assumed maximum number is 10.

Assets

Custom Fields (Hardware Assets)

The number of fields that can be added varies depending on the selected data type as shown below.

Number: 0 to 20 fields

A value in the range from -2147483647 to 2147483647 can be specified for each field.

Date: 0 to 10 fields

A date in the range from 1900/1/1 to 9000/12/31 can be specified for each field.

Enumeration: 0 to 20 fields

There is no upper limit on the number of options for each field.

Text: 0 to 75 fields

0 to 256 characters can be specified for each field.

0 item

The assumed maximum number of options that can be added for Enumeration fields is 50.

Custom Fields (Software License)

The number of fields that can be added varies depending on the selected data type as shown below.

Number: 0 to 10 fields

A value in the range from -2147483647 to 2147483647 can be specified for each field.

Date: 0 to 10 fields

A date in the range from 1900/1/1 to 9000/12/31 can be specified for each field.

Enumeration: 0 to 10 fields

There is no upper limit on the number of options for each field.

Text: 0 to 10 fields

0 to 256 characters can be specified for each field.

0 item

The assumed maximum number of options that can be added for Enumeration fields is 50.

Custom Fields (Contracts)

The number of fields that can be added varies depending on the selected data type as shown below.

Number: 0 to 10 fields

A value in the range from -2147483647 to 2147483647 can be specified for each field.

Date: 0 to 10 fields

A date in the range from 1900/1/1 to 9000/12/31 can be specified for each field.

Enumeration: 0 to 10 fields

There is no upper limit on the number of options for each field.

Text: 0 to 10 fields

0 to 256 characters can be specified for each field.

0 item

The assumed maximum number of options that can be added for Enumeration fields is 50.

Asset Status

0 to 100 items can be added in addition to the default.

4 items

By default, Unconfirmed, In Stock, In Use, and Disposed are registered for Asset Status.

These items are the same as those of the Assets module.

Device Type

0 to 100 items can be added in addition to the default.

11 items

By default, PC, Server, Storage, Network Device, Printer, Smart Device, Peripheral Device, USB Device, Display, Other, and Unknown are registered for Device Type.

These items are the same as those of the Assets module.

License Status

0 to 100 items can be added in addition to the default.

2 items

By default, In Use and Expired are registered for License Status.

These items are the same as those of the Assets module.

License Type

0 to 100 items can be added in addition to the default.

2 items

By default, Install License and Other are registered for License Type.

These items are the same as those of the Assets module.

Contract Status

0 to 100 items can be added in addition to the default.

3 items

By default, Active, Canceled, and Expired are registered for Contract Status.

These items are the same as those of the Assets module.

Contract Type

0 to 100 items can be added in addition to the default.

5 items

By default, Lease, Rent, Maintenance, and Support, Fixed are registered for Contract Type.

These items are the same as those of the Assets module.

Contract Vendor Name

There is no upper limit.

0 item

The assumed maximum number of items that can be registered is 60.

This item is the same as the item of the Assets module.

Number of items for Export Columns (Contract Vendor List)

1 to 6

6 items

--

Inventory

Software List

There is no upper limit.

0 item

The assumed maximum number of items that can be registered is 30.

Detection Conditions for Device Maintenance

There is no upper limit.

0 item

The assumed maximum number is 10.

General

Active Directory domain

There is no upper limit.

0 item

This item is the same as the item of the Home module (Getting Started button).

MDM server information

There is no upper limit.

0 item

The assumed maximum number of items that can be registered is 10.

Note: Even for items that have no upper limit, registering a huge amount of information might affect performance. For example, search performance might be degraded.

Menu area

Function

Item

Limit value

Default

Description

Menu area

Total number of groups

There is no upper limit.

--

When the number of managed computers is 30,000 or fewer, the assumed maximum numbers of groups are as follows:

Including user-defined groups: 1,500

Excluding user-defined groups: 1,200

When the number of managed computers is 30,000 to 50,000, the assumed maximum numbers of groups are as follows:

Including user-defined groups: 2,200

Excluding user-defined groups: 1,900

When the number of managed computers is 50,000 to 100,000, the assumed maximum numbers of groups are as follows:

Including user-defined groups: 3,950

Excluding user-defined groups: 3,650

When the number of managed computers is 100,000 to 300,000, the assumed maximum numbers of groups are as follows:

Including user-defined groups: 10,950

Excluding user-defined groups: 10,650

User-Defined Groups

There is no upper limit.

--

The assumed maximum number of groups is 300.

User-Defined Group Conditions

0 to 10

--

--

Total number of devices assigned to user-defined groups

There is no upper limit.

--

The assumed maximum number of devices is 100,000.

Security module

Assets module

Inventory module

Distribution (ITDM-compatible) module

Custom Group

There is no upper limit.

0 group

The assumed maximum number of groups that can be registered for each module is 50.

Items that can be added for custom groups

There is no upper limit.

0 item

The assumed maximum number of items that can be added is 5,000.

Security module

Assets module

Inventory module

Distribution (ITDM-compatible) module

Events module

Filter

There is no upper limit.

Depends on the module

The assumed maximum number of items that can be registered for each module is 50.

Filter Conditions

1 to 10 items

5 items

--

Security module

Update Group

There is no upper limit.

0 group

The assumed maximum number of groups that can be registered is 200.

Updates that can be added to Update Group

There is no upper limit.

0 item

The assumed maximum number of updates that can be registered is 3,000.

Note: Even for items that have no upper limit, registering a huge amount of information might affect performance. For example, search performance might be degraded.

Remote Install Manager

Function

Item

Limit value

Default

Description

Packages

Packages

0 to 331,776

--

The following are the details of the upper limit of packages:

The maximum number of cabinets

1,296

The maximum number of packages for a cabinet

256

Jobs

Jobs

There is no upper limit.

--

--

Number of agents per job

There is no upper limit.

--

The assumed maximum number of agents is 3,000.

Note: Even for items that have no upper limit, registering a very large amount of information might affect performance. For example, search performance might be degraded.

A.8 Times at which functions are executed automatically

When the OS of the managed computer is Windows

The time at which a function is executed automatically varies depending on the function as shown in the table below.

For details about the time at which a report is calculated, see 2.16.5 Calculation schedules for reports.

Function

Description

Execution time

Device management

Collecting information from agentless devices

Regularly collect information from agentless devices and update the information to the latest status.

Every hour#1

Obtaining information from Active Directory

Search for computers

managed by Active Directory, and then register them inJP1/IT Desktop Management 2. It is also possible to automatically install agents during the search. In addition, the configuration of departments is automatically registered in JP1/IT Desktop Management 2.

Every day at 23:00#1

Collecting user information

If End User is specified as the input method for the department, location, user name, or other asset management item, the Enter User Information dialog box appears on the user's computer, and the system collects the information the user enters.

When input of user information is complete

Collecting device revision history

When device information changes, the system compares the new device information against the old, and compiles the results as a revision history.

Every day at 0:00#2

Detecting the devices suggested for deletion during device maintenance

The system starts processing to detect devices suggested for deletion. These are devices that meet the pre-defined conditions for duplicate devices or idle devices.

Every day at 23:00#2

Security control

Evaluating the security status

Based on the device information collected from computers, determine the violation levels according to the security policy.

Every day at 0:00#1

Every day at 18:00 for the management server which the large-scale management option is enabled.

Regularly checking and updating support information

Connect to the service site according to the update schedule specified in the Product Update view of the Settings module, and automatically update information about Windows updates and anti-virus products.

When the latest information is obtained from the support service site, whether the latest Windows updates and anti-virus products are applied to the managed computer can be determined based on the security policy.

Every day at a specified time (the time when the setup for JP1/IT Desktop Management 2 was completed, rounded up to the nearest hour)#1

Updating Scan Engine Version and Virus Definition File Version settings for anti-virus products

Detect the latest versions of the scan engine and virus definition file for the anti-virus products specified for the security policy from the information collected from computers. Then update the Scan Engine Version and Virus Definition File Version security policy settings and evaluate the security status.

When information about the versions of the scan engine and virus definition file collected from computers is updated

Operation logs

Storing operation logs

Store the operation logs obtained from computers.

Every hour

Periodically exporting operation logs

Periodically export the operation logs obtained from computers.

Every hour

Monitoring free space for the operation log backup folder

Obtain information about free space for the operation log backup folder. If the amount of free space is insufficient, output an event. Use the event mail notification function to notify the administrator of insufficient capacity.

Every day at 6:00#2

Deleting the operation log database and re-creating the index information

Delete the operation logs that exceeded the storage period from the operation log database, and re-create the index information. Additionally, operation logs that were collected manually are deleted and the area is also released. This ensures more efficient use of the database capacity.

Every day at 1:00#2

Events

Monitoring event occurrence

If an event of a predefined category and severity occurred, send a notification email to the administrator.

Every 30 minutes#1

Others

Obtaining information from an MDM system

Obtain smart device information managed by the MDM system according to the import schedule specified in the MDM Linkage Settings view of the Settings module. If information about a new smart device is obtained, the smart device is discovered as a new device. If information about a managed smart device is obtained, the device information and hardware asset information are updated.

Every day at a specified time (the time when the setup for JP1/IT Desktop Management 2 was completed, rounded up to the nearest later hour)#1

Regularly releasing used free pages in the database

Release used free pages that were generated when database data was deleted. This enables efficient use of the database capacity.

Every day at 5:00#2

#1: You can specify the execution time in the Settings module.

#2: You can specify the execution time in the configuration file.

When the OS of the managed computer is UNIX or Mac

The tables below describe the time at which a function is executed automatically, and the reported information.

The time at which a function is executed automatically

Trigger function

Description

Connection of a manager

System configuration information is reported when a computer running UNIX or Mac is connected to a manager as an agent. You can check the system configuration information of an agent for UNIX or Mac in the Remote Install Manager window. In other operation windows such as the Inventory module, this information is included in the system information.

Execution of a job

Information is reported when a Get system information from computer (UNIX) job or Get software information from computer (UNIX) job is executed. The information is also reported when these jobs are executed on a Mac agent.

Distribution of a Hitachi program product

Information is reported when a Hitachi program product is distributed using Remote Install Manager. Note that Hitachi program products cannot be distributed to Mac agents.

System change

Information is reported when a change of system is detected, being triggered by an execution of a distribution job or a polling from an agent for UNIX or Mac.

Items of the system configuration information

Item

Description

Node attribute

Attribute of the node, This is Agent for an agent for UNIX or Mac.

Host ID

A unique ID generated by an agent to distinguish devices. A host ID for an agent for UNIX or Mac is a string of 28-byte characters, starting with #U.

Host Name

A host name assigned to a computer (the host name acquired by the gethostname command). If DMHOSTNAME is specified in the operating-environment settings file, the value specified for DMHOSTNAME is reported.

IP Address

IP address assigned to the host name. If DMIPADDR is specified in the operating-environment settings file, the value specified for DMIPADDR is reported.

MAC Address

The MAC address for the NIC to which the IP address is assigned is reported.

Creation date and time of the system configuration information

The date and time when the system configuration information for an agent for UNIX or Mac is created is reported.

A.9 Cases in which settings are applied after a restart

You sometimes need to restart a computer to apply settings for JP1/IT Desktop Management 2. A restart is required in the following cases:

When a security policy is edited or assigned

When security measures are manually performed

When a security policy is edited

If you edit any of the following items, restart the computer to which the edited security policy is assigned. The items inside the parentheses indicate the relevant security configuration items. After the computer is restarted, the edited security policy is applied to that computer.

Auto enforce of Enable Automatic Update (Windows Update)

Auto enforce of Disable Administrative Share (OS Security)

Auto enforce of Disable Anonymous Access (OS Security)

Auto enforce of Enable Firewall (OS Security)

The following OSs do not require a restart: Windows Server 2003 and Windows XP

Auto enforce of Disable DCOM (OS Security)

Auto enforce of Disable Remote Desktop (OS Security)

Suppression of Device Usage (Other Access Restrictions)#

Enable or disable Acquisition of Operation Logs (including acquisition of Suspicious Operations To Be Reported) (Operation Logs)#

# The settings of Suppression of Device Usage and Acquisition of Operation Logs are applied when a security policy is assigned. However, we recommend that you restart your computer, because some of settings related to the suppression of device usage or to operation logs take effect only after a restart.

The settings that take effect after a restart are as follows.

Classification

Setting Item

operation logs

operation logs

Copy file

Move file

Rename file

Create file

Delete file

Web Access (Upload)

Web Access (Download)

FTP (Send File)

FTP (Receive File)

Send Mail (Attachment File)

Receive Mail (Attachment File)

Save Attached File

Copy folder

Move folder

Rename folder

Create folder

Delete folder

Suspicious operations

Send/Receive E-mail with Attachments

Use Web/FTP Server

Copy/Move the File to External Device

Other Access Restrictions

Suppression of write operation

Removable disks

CD/DVD drives

FD drives

When a security policy is assigned

Restart the computer to which the security policy is assigned. After the computer is restarted, the assigned security policy is applied to that computer.

The settings of Suppression of Device Usage and Acquisition of Operation Logs are applied when a security policy is assigned. However, some settings of Suppression of Device Usage and Operation Logs might take effect after a restart.

When security measures are manually performed

If you specify any of the following configuration items, restart the computer for which the items have been specified. The items inside the parentheses indicate the relevant security configuration items. After the computer is restarted, the security measures are executed on the computer.

Enable Automatic Update (Windows Update)

Disable Administrative Share (OS Security)

Disable Anonymous Access (OS Security)

Enable Firewall (OS Security)

The following OSs do not require a restart: Windows Server 2003 and Windows XP

Disable DCOM (OS Security)

Disable Remote Desktop (OS Security)

A.10 Connectivity with lower versions

The following tables describe compatibility when products of different versions are connected.

Connectivity between an agent and a manager

Agent

Manager

10-00

J

10-01

J

10-01

M

10-02

J

10-10

J

10-10

M

10-50

J

10-50

M

11-00

J

11-01

J

11-10

J

11-50

J

11-51

J

12-00

J

12-10

J

12-50

J

12-60

J

13-00

J

13-01

J

13-10

J

13-11

J

10-00 J

Y

A

N

A

A

N

A#1

N

A#1

A#1, #2

A#1, #2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

10-01 J

N

Y

N

A

A

N

A#1

N

A#1

A#1, #2

A#1, #2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

10-01 M

N

N

Y

N

N

A

N

A#1

A#1

A#1, #2

A#1, #2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

10-02 J

N

N

N

Y

A

N

A#1

N

A#1

A#1, #2

A#1, #2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

10-10 J

N

N

N

N

Y

N

A#1

N

A#1

A#1, #2

A#1, #2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

10-10 M

N

N

N

N

N

Y

N

A#1

A#1

A#1, #2

A#1, #2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

A#1,#2

10-50 J

N

N

N

N

N

N

Y

N

A

A#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

10-50 M

N

N

N

N

N

N

N

Y

A

A#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

11-00 J

N

N

N

N

N

N

N

N

Y

A#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

11-01 J

N

N

N

N

N

N

N

N

N

Y#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

11-10 J

N

N

N

N

N

N

N

N

N

N

Y#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

11-50 J

N

N

N

N

N

N

N

N

N

N

N

Y#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

11-51 J

N

N

N

N

N

N

N

N

N

N

N

N

Y#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

12-00 J

N

N

N

N

N

N

N

N

N

N

N

N

N

Y#2

A#2

A#2

A#2

A#2

A#2

A#2

A#2

12-10 J

N

N

N

N

N

N

N

N

N

N

N

N

N

N

Y#2

A#2

A#2

A#2

A#2

A#2

A#2

12-50 J

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

Y#2

A#2

A#2

A#2

A#2

A#2

12-60 J

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

Y#2

A#2

A#2

A#2

A#2

13-00 J

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

Y#2

A#2

A#2

A#2

13-01 J

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

Y#2

A#2

A#2

13-10 J

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

Y#2

A#2

13-11 J

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

Y#2

Legend:

J: JP1/IT Desktop Management or JP1/IT Desktop Management 2

M: Job Management Partner 1/IT Desktop Management or Job Management Partner 1/IT Desktop Management 2

Y: Can be connected. A: Can be connected by agent functions for each version only. N: Cannot be connected.

#1: You can not change the security policy of the restricting prohibited operations.

#2: If JP1/IT Desktop Management 2 - Operations Director is used as a manager, onlyagents of JP1/IT Desktop Management 2 - Operations Director can be connected.

Connectivity between a network monitor agent and an agent

Network monitor agent

Agent

10-00

J

10-01

J

10-01

M

10-02

J

10-10

J

10-10

M

10-50

J

10-50

M

11-00

J

11-01

J

11-10

J

11-50

J

11-51

J

12-00

J

12-10

J

12-50

J

12-60

J

13-00

J

13-01

J

13-10

J

13-11

J

10-00 J

Y

A

N

A

A

N

A

N

A

A

A

A

A

A

A

A

A

A

A

A

A

10-01 J

N

Y

N

A

A

N

A

N

A

A

A

A

A

A

A

A

A

A

A

A

A

10-01 M

N

N

Y

N

N

A

N

A

A

A

A

A

A

A

A

A

A

A

A

A

A

10-02 J

N

N

N

Y

A

N

N

N

A

A

A

A

A

A

A

A

A

A

A

A

A

10-10 J

N

N

N

N

Y

N

A

N

A

A

A

A

A

A

A

A

A

A

A

A

A

10-10 M

N

N

N

N

N

Y

N

A

A

A

A

A

A

A

A

A

A

A

A

A

A

10-50 J

N

N

N

N

N

N

Y

N

A

A

A

A

A

A

A

A

A

A

A

A

A

10-50 M

N

N

N

N

N

N

N

Y

A

A

A

A

A

A

A

A

A

A

A

A

A

11-00 J

N

N

N

N

N

N

N

N

Y

A

A

A

A

A

A

A

A

A

A

A

A

11-01 J

N

N

N

N

N

N

N

N

N

Y

A

A

A

A

A

A

A

A

A

A

A

11-10 J

N

N

N

N

N

N

N

N

N

N

Y

A

A

A

A

A

A

A

A

A

A

11-50 J

N

N

N

N

N

N

N

N

N

N

N

Y

Y

A

A

A

A

A

A

A

A

12-00 J

N

N

N

N

N

N

N

N

N

N

N

N

N

Y

Y

Y

Y

A

A

A

A

13-00 J

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

Y

Y

Y

Y

Legend:

J: JP1/IT Desktop Management or JP1/IT Desktop Management 2

M: Job Management Partner 1/IT Desktop Management or Job Management Partner 1/IT Desktop Management 2

Y: Can be connected. A: Can be connected by agent functions for each version only. N: Cannot be connected.

Connectivity between Remote Control Agent and a controller

Remote control agent

Controller

10-00

J

10-01

J

10-01

M

10-02

J

10-10

J

10-10

M

10-50

J

10-50

M

11-00

J

11-01

J

11-10

J

11-50

J

11-51

J

12-00

J

12-10

J

12-50

J

12-60

J

13-00

J

13-01

J

13-10

J

13-11

J

10-00 J

Y

A

N

A

A

N

A

N

A

A

A

A

A

A

A

A

A

A

A

A

A

10-01 J

N

Y

N

A

A

N

A

N

A

A

A

A

A

A

A

A

A

A

A

A

A

10-01 M

N

N

Y

N

N

A

N

A

A

A

A

A

A

A

A

A

A

A

A

A

A

10-02 J

N

N

N

Y

A

N

A

N

A

A

A

A

A

A

A

A

A

A

A

A

A

10-10 J

N

N

N

N

Y

N

A

N

A

A

A

A

A

A

A

A

A

A

A

A

A

10-10 M

N

N

N

N

N

Y

N

A

A

A

A

A

A

A

A

A

A

A

A

A

A

10-50 J

N

N

N

N

N

N

Y

N

A

A

A

A

A

A

A

A

A

A

A

A

A

10-50 M

N

N

N

N

N

N

N

Y

A

A

A

A

A

A

A

A

A

A

A

A

A

11-00 J

N

N

N

N

N

N

N

N

Y

A

A

A

A

A

A

A

A

A

A

A

A

11-01 J

N

N

N

N

N

N

N

N

N

Y

A

A

A

A

A

A

A

A

A

A

A

11-10 J

N

N

N

N

N

N

N

N

N

N

Y

A

A

A

A

A

A

A

A

A

A

11-50 J

N

N

N

N

N

N

N

N

N

N

N

Y

A

A

A

A

A

A

A

A

A

11-51 J

N

N

N

N

N

N

N

N

N

N

N

N

Y

A

A

A

A

A

A

A

A

12-00 J

N

N

N

N

N

N

N

N

N

N

N

N

N

Y

A

A

A

A

A

A

A

12-10 J

N

N

N

N

N

N

N

N

N

N

N

N

N

N

Y

A

A

A

A

A

A

12-50 J

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

Y

A

A

A

A

A

12-60 J

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

Y

A

A

A

A

13-00 J

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

Y

A

A

A

13-01 J

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

Y

A

A

13-10 J

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

Y

A

13-11 J

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

Y

Legend:

J: JP1/IT Desktop Management or JP1/IT Desktop Management 2

M: Job Management Partner 1/IT Desktop Management or Job Management Partner 1/IT Desktop Management 2

Y: Can be connected. A: Can be connected by agent functions for each version only. N: Cannot be connected.

Connectivity between Internet Gateway and a manager

Internet Gateway

Manager

11-51 J or earlier

12-00 J

12-10 J

12-50 J

12-60 J

13-00 J

13-01 J

13-10 J

13-11 J

12-00 J

N

Y

Y

Y

Y

A

A

A

A

13-00 J

N

N

N

N

N

Y

Y

A

A

13-10 J

N

N

N

N

N

N

N

Y

Y

Legend:

J: JP1/IT Desktop Management or JP1/IT Desktop Management 2

Y: Can be connected. A: Can be connected by Internet Gateway functions for each version only. N: Cannot be connected.

Note: See Connectivity between Internet Gateway and management relay server for information about the connectivity of Internet gateways with JP1/IT Desktop Management 2 - Manager installed as a management relay server.

Connectivity between Internet Gateway and an agent

Agent

Internet Gateway

12-00 J

13-00 J

13-10 J

11-51 J or earlier

--

--

--

12-00 J

Y

A

A

12-10 J

Y

A

A

12-50 J

Y

A

A

12-60 J

Y

A

A

13-00 J

N

Y

A

13-01 J

N

Y

A

13-10 J

N

N

Y

13-11 J

N

N

Y

Legend:

J: JP1/IT Desktop Management or JP1/IT Desktop Management 2

Y: Can be connected. --: Not applicable. A: Can be connected by agent functions for each version only. N: Cannot be connected.

Connectivity between Internet Gateway and management relay server

Internet Gateway

Manager

11-51 J or earlier

12-00 J

12-10 J

12-50 J

12-60 J

13-00 J

13-01 J

13-10 J

13-11 J

12-00 J

N

N

N

N

N

N

N

N

N

13-00 J

N

N

N

N

N

N

N

N

N

13-10 J

N

N

N

N

N

N

N

Y

Y

Legend:

J: JP1/IT Desktop Management or JP1/IT Desktop Management 2

Y: Can be connected. N: Cannot be connected.

A.11 Functional differences between an agent for Windows, agent for UNIX, and agent for Mac

This section describes the functional differences among JP1/IT Desktop Management 2 - Agent for Windows, JP1/IT Desktop Management 2 - Agent for UNIX, and JP1/IT Desktop Management 2 - Agent for Mac.

Difference of terms

Some terms are different between agents for Windows and agents for UNIX. When you use JP1/IT Desktop Management 2 - Agent for UNIX, replace the terms as follows.

Windows terms

UNIX terms

ID

ID group

Installation

Installation#

Remote installation

Package distribution (software distribution)

Remote collection

File collection

#: In UNIX, installation refers to the processes from installation to setup.

Functional differences

The table below shows functional differences. The table also shows whether operations from a manager to an agent are supported.

Remote installation (software distribution)

Item

Agent for Windows

Agent for UNIX

Agent for Mac

Installation driven by the managing server

Yes

Yes

Yes

Installation performed by the user of the agent

Yes

Yes

No

Distribution of JP1/IT Desktop Management 2 - Agent (agent)

Yes

Yes#1

Yes#1

Distribution of JP1/IT Desktop Management 2 - Agent (relay system)

Yes

No

No

Suppression of installation based on system conditions

Yes

No

No

Suppression of installation based on software conditions

Yes

No

No

Suppression of installation based on package conditions

Yes

No

No

Schedule of distribution

Yes

Yes

Yes

Specification of installation date and time

Yes

Yes

Yes

Specification of installation timing

Yes#2

Yes#3

Yes#2

Automatic restart of a computer after installation

Yes

Yes

Yes

Display of in-progress dialog box (when configuring a package)

Yes

No

No

Display of in-progress dialog box (when configuring the agent setup)

Yes

No

No

Start of an external program linked with remote installation

Yes#4

Yes#5

Yes#5

Automatic installation of a package

Yes

Yes

Yes

Installation using an AIT file

Yes

No

No

Installation by specifying a host group

Yes

Yes

Yes

Installation by specifying an ID

Yes

Yes

Yes

Split distribution

Yes

Yes#6

Yes#6

Multicast distribution

Yes

No

No

Suspending and resuming jobs

Yes

Yes

Yes

Distribution of suspended jobs

Yes

Yes

Yes

Remote start and shutdown driven by a client

Yes

Yes#7

Yes#7

Offline installation

Yes

No

No

Legend: Yes: Supported. No: Not supported.

#1: Distribution using Remote Install Manager can be performed.

#2: Normal installation (Immediately) and installation when the system starts (When System Starts up)

#3: Normal installation (Immediately), installation when the system starts (When System Starts up), and installation when the system stops (When System Stops)

#4: An external program can be started before and after a distribution and when an error occurs.

#5: An external program can be started before and after a distribution.

#6: Split distribution can be performed only on end workstations.

#7: An agent for UNIX or Mac cannot be shut down after a job is executed.

Packaging

Item

Agent for Windows

Agent for UNIX

Agent for Mac

Compression of package data

Yes

Yes

Yes

Legend: Yes: Supported.

Remote collection (file collection)

Item

Agent for Windows

Agent for UNIX

Agent for Mac

Remote collection

Yes

Yes

No

File name by full path#1

Yes

Yes

No

Specification of collection timing

Yes#2

Yes#2

No

Start of an external program linked with remote collection

Yes

Yes

(Before and after the collection)

No

Remote start and shutdown driven by a client

Yes

Yes#3

No

Compression of collection files

Yes

Yes

No

Legend: Yes: Supported. No: Not supported.

#1: The maximum number of characters for the specifiable path name is as follows:

Agent for Windows: 256 single-byte characters

Agent for UNIX: 63 single-byte characters

#2: When the agent starts and when the agent is running

#3: An agent for UNIX cannot be shut down after a job is executed.

Remote control

Item

Agent for Windows

Agent for UNIX

Agent for Mac

Linux

Non-Linux

Remote control of an agent

Yes

Yes#

No

Yes#

File transfer using remote control functions

Yes

No

No

No

Legend: Yes: Supported. No: Not supported.

#: Remote control via an RFB connection can be used.

Internet Gateway

Item

Agent for Windows

Agent for UNIX

Agent for Mac

Managing computers connected via an Internet Gateway

Yes

No

No

Legend: Yes: Supported. No: Not supported.

A.12 Restrictions when using Asset Console to manage assets

This section describes the restrictions that apply in environments that use Asset Console to manage assets when the Suppress operations on asset information from the operation window check box is selected in the management server setup.

Note

The changed asset status is not applied to the asset information managed by Asset Console, even if you select the check box Change the asset status of hardware assets associated with deleted devices in the Asset Status Settings of Hardware Assets Associated with Deleted Devices view (under Assets) of the Settings module.

Assets module

You cannot add asset information in the Hardware Assets view. If you attempt to delete or edit the hardware asset information for hardware of any Device Type other than USB device, the operation will not apply to the asset information managed in Asset Console.

You cannot add, edit, delete, or view asset information in the following views:

Import Assets wizard#

Software Licenses view

Managed Software view

Software License Status view

Contract view

#: You can add and edit information in the Hardware Assets view. However, the changes you make do not apply to the asset information managed by Asset Console.

Inventory module

You cannot transfer software licenses or add managed software in the following views:

Device Inventory view

Software Inventory view

Settings module

You cannot add, edit, or remove items in a contract vendor list in the following view:

Contract Vendor List view

A.13 Functional restrictions in JP1/IT Desktop Management 2 - Operations Director

Compared with JP1/IT Desktop Management 2 - Manager, some functions of JP1/IT Desktop Management 2 - Operations Director are restricted. The following table lists and describes the restricted functions.

Restricted function

Description

Operation in a multi-server configuration

JP1/IT Desktop Management 2 - Operations Director only supports operation in a single-server configuration. A maximum of 1,000 servers can be managed.

Operation in a multi-server configuration containing a primary management server, management relay servers, and relay systems is not possible.

Distribution using Remote Install Manager

JP1/IT Desktop Management 2 - Operations Director only supports ITDM-compatible distribution, which is a distribution method that uses the JP1/IT Desktop Management 2 operation window. Remote Install Manager is not supported.

Asset management using Asset Console

JP1/IT Desktop Management 2 - Operations Director only supports the asset management method that uses the JP1/IT Desktop Management 2 operation window.

Management of UNIX devices

Agents of JP1/IT Desktop Management 2 - Operations Director support computers that run Windows or Mac.

Linkage with other JP1 products

JP1/IT Desktop Management 2 - Operations Director cannot link with the following JP1 products:

JP1/NETM/NM - Manager

JP1/IM

JP1/IT Desktop Management 2 - Smart Device Manager

MobileIron is the only MDM system that JP1/IT Desktop Management 2 - Operations Director can link with.

JP1/Audit Management - Manager

Related Topics:

2.18 Managing a large system comprised of multiple departments or networks

4.4.3 Multi-server configuration

2.12 Distributing software and files by using Remote Install Manager

2.11 Managing assets

2.5 Installing the agent

2.8.20 Network control function by linking with JP1/NETM/NM - Manager

2.15.4 Checking events on the JP1/IM event console

2.23 Controlling smart devices

4.4.8 MDM linkage configuration

A.14 Version changes

(1) Changes in 13-11

(a) Changes in the manual (3021-3-L72-30(E))

When using Google Workspace as an integrated MDM system, Chromebook devices can now be managed.

When managing Windows PCs using Microsoft Intune as an integrated MDM system, malware-infected devices can now be automatically block from the network.

The HIBUN log added in HIBUN version 13 can be imported.

When exporting operation logs, the IP address of the Agent can also be output.

(2) Changes in 13-10

(a) Changes in the manual (3021-3-L72-20(E))

When using Microsoft Intune as an integrated MDM system, Windows PCs can now be managed.

Command prompt and PowerShell operation logs can be retrieved.

It is now possible to connect from a managed relay server to an Internet gateway server via the Internet.

(3) Changes in 13-01

(a) Changes in the manual (3021-3-L72-10(E))

Added Microsoft Intune to MDM system to work with.

The flow rate control can be performed with relay system.

(4) Changes in 13-00

(a) Changes in the manual (3021-3-L72(E))

Windows Server 2022 was added as an applicable operating system for the following products:

JP1/IT Desktop Management 2 - Manager

JP1/IT Desktop Management 2 - Agent

JP1/IT Desktop Management 2 - Network Monitor

JP1/IT Desktop Management 2 - Asset Console

JP1/IT Desktop Management 2 - Internet Gateway

Windows 11 was added as an applicable operating system for the following products:

JP1/IT Desktop Management 2 - Agent

JP1/IT Desktop Management 2 - Network Monitor

Windows Server 2012 was removed from applicable OSs for the following products:

JP1/IT Desktop Management 2 - Manager

JP1/IT Desktop Management 2 - Asset Console

JP1/IT Desktop Management 2 - Internet Gateway

Add the priority distribution function.

The operation log can be acquired by Microsoft Edge.

Change the default value of the setup for distribution with Remote Install Manager.

Add the following properties that can be set by the configuration file:

Settings to suppress the network group automatic generation

Settings that do not perform identification when registering devices

Settings to suppress automatic update of network control list

Alert threshold of the Network Control List

Set whether to notify notification items on the home screen when the number of network control list registrations reaches the warning threshold and the limit is reached

(5) Changes in 12-60

(a) Changes in the manual (3021-3-E12-30(E))

Maximum of 300,000 devices can be managed.

Agents can now be installed on computers running the following OSs:

macOS 10.15

macOS 11

Software information can now be searched for at any time with the softwaresearch command.

Operation Date/Time (UTC) was added to the information items to be collected in the operation log.

The All Assets Cost report, which totals the cost values of hardware assets, software license, and other, was added to Asset Detail Reports.

(6) Changes in 12-50

(a) Changes in the manual (3021-3-E12-20(E))

Devices on which network monitors are enabled can now be forcibly deleted.

A new network monitor setting can allow events to be issued whenever unauthorized devices access the network.

Asset association information can now be imported and exported.

Agents can now be installed on computers running the following OSs: CentOS 8.1, Red Hat Enterprise Linux(R) Server 8, and Oracle Linux 8.

(7) Changes in 12-10

(a) Changes in the manual (3021-3-E12-10(E))

Windows Server 2019 was added as an applicable operating system for the following products:

JP1/IT Desktop Management 2 - Manager

JP1/IT Desktop Management 2 - Agent

JP1/IT Desktop Management 2 - Network Monitor

JP1/IT Desktop Management 2 - Asset Console

JP1/IT Desktop Management 2 - Internet Gateway

Remote Install Manager

The Hardware Assets Cost report and the Software License Cost report can now display the total cost calculated based on the contract information valid at the time the report is displayed. Furthermore, the Other Cost report was added.

Devices can now be managed from an external system via the API.

Shared VDI-based virtual computers can now be managed.

Windows updates and a feature update to Windows 10 can now be packaged for distribution by using Remote Install Manager.

The management window was changed to HTML5. Furthermore, Adobe Flash Player is no longer a prerequisite for an administrator's computer.

The check box beside Automatic update of components, which is one of the parameters used to set up the management server, is now not selected by default.

MobileIron 10 was added as a version that supports MDM linkage configurations.

(8) Changes in 12-00

(a) Changes in the manual (3021-3-E12(E))

Windows Server 2008 R2 was removed from applicable OSs for the following products:

JP1/IT Desktop Management 2 - Manager

JP1/IT Desktop Management 2 - Network Monitor

JP1/IT Desktop Management 2 - Asset Console

Remote Install Manager

Computers can now be managed via the Internet.

Improvements were made to the security judgment for cumulative updates and Security Monthly Quality Rollup for Windows.

Added the following OSs in a computer on which an agent will be installed requires one of the OSs:

macOS 10.13

macOS 10.14

Added the NAT Environment Configuration.

(9) Changes in 11-51

(a) Changes in the manual (3021-3-B52-40(E))

A security policy can now be set for offline-managed devices.

HIBUN logs can now be imported into JP1/IT Desktop Management 2.

When importing hardware asset information, users can now select whether to register the information as new hardware asset information if it is not associated.

Remote Install Manager can now distribute a file larger than 2 gigabytes.

(10) Changes in 11-50

(a) Changes in the manual (3021-3-B52-30(E))

For agents for Mac, the distribution of software and files (remote installation) is now enabled. Additionally, these agents are judged for security status based on security policies.

The managed software information now includes information on which operating system the software program is installed on. This enables the licenses of a software program to be managed for each operating system.

The information on BitLocker drive encryption is now available.

Account information and screen saver information, which can be collected as part of security information that constitutes device information, can now be collected for a maximum of 60 users.

The following products were added to the list of products whose purchasing status and GUID can be collected as part of installed software information:

Microsoft Office Professional Plus 2016

Microsoft Office Standard 2016

Microsoft Skype for Business 2016

Microsoft Access 2016

Microsoft Excel 2016

Microsoft Outlook 2016

Microsoft PowerPoint 2016

Microsoft Project Professional 2016

Microsoft Project Standard 2016

Microsoft Publisher 2016

Microsoft Visio Professional 2016

Microsoft Visio Standard 2016

Microsoft Word 2016

You can now use a command to control network access of devices.

You can now install an agent on the server on which Citrix XenApp and Microsoft RDS have been installed and manage it with JP1/IT Desktop Management 2.

Assets that are allowed to use a USB device can now be limited based on the department, location, or associated asset.

A list of update programs registered with a management server can now be exported to a CSV file. Additionally, the exported CSV file containing patch information can now be imported to the source management server or other management servers.

Supported anti-virus products were added.

(11) Changes in 11-10

(a) Changes in the manual (3021-3-B52-20(E))

Windows Server 2016 was added as an applicable operating system for the following products:

JP1/IT Desktop Management 2 - Manager

JP1/IT Desktop Management 2 - Agent

JP1/IT Desktop Management 2 - Network Monitor

JP1/IT Desktop Management 2 - Asset Console

Remote Install Manager

An agent can now be managed after being installed on a computer running Mac OS. (The device type will be PC.)

Provided functionality

Acquisition of system information and software information

Remote control via RFB connections (already provided for agentless management)

Network control (enabling or disabling network access on demand)

Unavailable functionality (including functionality in development)

Software and file distribution (remote installation)

Collection of files (remote collection)

Agent settings and agent deployment

Security management (security judgments, automated countermeasures)

Operation logs

Device control

By linking with JP1/Base, you can now log in to JP1/IT Desktop Management 2 by using JP1 authentication.

The device status can now be set when device information is acquired for the first time from computers managed offline.

Information about Windows Store apps can now be collected as installed software information.

Supported antivirus products were added.

The following product was added as an applicable OS for JP1/IT Desktop Management 2 - Agent:

Red Hat Enterprise Linux 5

As files that are to be executed automatically during installation, ZIP files for installers of related products, such as Hibun, can now be set.

A maximum of 50,000 devices can now be managed.

(12) Changes in 11-01

(a) Changes in the manual (3021-3-B52-10(E))

JP1/IT Desktop Management 2 - Operations Director was added as a relevant program product.

Windows 10 was added as an applicable operating system for JP1/IT Desktop Management 2 - Network Monitor.

You can now specify detection conditions for duplicate or idle devices in order to detect devices suggested for deletion, and then delete them automatically or manually.

You can now specify whether the agents to be deployed include remote control agents.

The asset status of the associated hardware assets can now be automatically changed when a device is deleted.

The Windows OS version can now be acquired.

The description of the kernel version that can be collected as system information was amended.

The description of the installed software information collected for a Windows agent was amended.

You can now collect information about version 11 of Hibun products (Hibun DC, Hibun DE, and Hibun DP).

You can now manage smart device software.

The description of the remote control function for UNIX agents was removed.

Supported anti-virus products were added.

The description of the tooltip displayed when an operation log backup file for an earlier product (JP1/IT Desktop Management) is stored in the operation log backup folder was amended.

In the setup for distribution with Remote Install Manager, you can now specify the maximum transfer rate for sending packages from the management server to agents.

A description of the port numbers used on the administrator's computer (Remote Install Manager) and relay systems was added.

You can now use the file for connection destinations (itdmhost.conf) to specify the connection destination of an agent.

You can now select which menu items are to be displayed in the start menu of an agent.

A description about continuity with lower versions was added to 11-01. Notes on a security policy for restricting prohibited operations were added to the table showing the connectivity between an agent and a manager.

(13) Changes in 11-00

(a) Changes in the manual (3021-3-B52(E))

Site by site management and central management can now be achieved by operating JP1/IT Desktop Management 2 in a multi-server configuration system.

A description about when a network control list is updated was added.

A description that the network connection information can be imported and exported was added.

Windows 10 was added as an applicable OS for the following products:

JP1/IT Desktop Management 2 - Agent

JP1/IT Desktop Management 2 - RC Manager

Remote Install Manager

Windows Server 2003 and Windows Server 2008 (excluding Windows Server 2008 R2) were removed from applicable OSs for the following products:

JP1/IT Desktop Management 2 - Manager

JP1/IT Desktop Management 2 - Agent

JP1/IT Desktop Management 2 - Network Monitor

JP1/IT Desktop Management 2 - RC Manager

The following Web browsers and email clients were removed from operation log collection target:

Internet Explorer 7

Internet Explorer 8

Microsoft Outlook Express 6

Windows Mail 6

MobileIron 7.5 was added as a version that supports MDM linkage configurations.

A description was added to include the source of the device information that can be acquired from JP1/IT Desktop Management 2 - Smart Device Manager when linked with a MDM system.

The following products were added as supported anti-virus products:

Japanese version of anti-virus products

ウイルスバスター クラウド 8.0

ウイルスバスター コーポレートエディション 11.0

ウイルスバスター ビジネスセキュリティサービス 5.7.1193

ESET NOD32 Antivirus 8.0

Sophos Endpoint Security and Control for Windows 10.3.11, 10.3.13

Symantec Endpoint Protection 12.1.5

English version of anti-virus products

Avira Professional Security 14.0.4, 14.0.7

Kaspersky Endpoint Security 10 for Windows 10.2

McAfee SaaS Endpoint Protection 6.0

OfficeScan Corporate Edition 11.0

Sophos Endpoint Security and Control for Windows 10.3.7, 10.3.11

Symantec Endpoint Protection 12.1.4, 12.1.5

Titanium Internet Security 2015

The judgment conditions for whether the Japanese version of the following anti-virus products are resident or non-resident were added:

ESET Endpoint Antivirus

ESET File Security for Microsoft Windows Server

Kaspersky Endpoint Security 8 for Windows

Kaspersky Endpoint Security 10 for Windows

Sophos Endpoint Protection - Advanced

Sophos Endpoint Protection - Basic

Sophos Endpoint Protection - Enterprise

Sophos Endpoint Security and Control for Windows

The judgment conditions for whether the products ウイルスバスター and ウイルスバスタークラウド are resident or non-resident were reviewed.

Anti-virus product information can now be acquired from the support service site.

The list of limit values was updated.

A description was added about the operation when the setting for Detection of change in JP1/IT Desktop Management 2 - Agent is disabled.

A description on 11-00 was added about connectivity with a lower version.

The description on performance and estimates was updated.

Restriction imposed when asset is managed using Asset Console is added.

A link regarding device information collection was removed.

The Host ID was added to a list of asset fields in the asset information.

The Host ID was added to a list of fields that can be used to identify devices and hardware assets.

The Host ID was added to a list of hardware asset information fields that can be imported. Its description format was also added.

An agent can now be installed on a computer running UNIX to manage the UNIX computers (the device type is Server).

In the description about the browsers that can display the operation windows, the version of Firefox was changed to 31 or later.

The version of Adobe Flash Player required to display the operation windows was changed to 13.0 or later.

An explanation was added to indicate that, if the restoration scope covers data that is already restored, all operation logs are overwritten when they are restored.

A description was added about how to calculate the maximum number of days for which operation logs can be restored to the database when manually restoring operation logs.

An explanation was added to indicate that, if automatic restoration of operation logs is enabled when an operation log backup folder is not set, operation logs are automatically restored to the operation log database without being stored in an operation log backup folder.

The name of the add-on for Web access monitoring in the operation log is changed to JP1/IT Desktop Management 2 BHO.

The name of the add-on for file upload monitoring in the operation log is changed to JP1/IT Desktop Management 2 FUO.

The following explanation was added to the notes on restricting the use of devices: If you reconnect a device (other than a USB device) that connected to a computer and was then restricted by the computer, restriction messages cannot be displayed, and connection, disconnection, and restriction logs, as well as restriction events, cannot be acquired.

The following explanation was added to the notes on restricting the use of USB devices: A USB device must be registered as both a normal and a UASP asset when the USB device is recognized as a normal device and a UASP device, even though it is the same device.

Help information for JP1/IT Desktop Management 2 was deleted from the Help menu.

(Changes from only this manual (3021-3-368(E))) The software, purchasing status, product ID, GUID, and software type for some software can now be managed.

(14) Changes in 10-50

(a) Changes in the manuals (3021-3-274 and 3021-3-368(E))

The functionality of the site server configuration system was deleted. The relay system was added as a system required for distribution using Remote Installation Manager.

By using the functionality of distribution using Remote Installation Manager, the user can now specify, in detail, the required conditions for the managed computers and their actions.

Integrated management of hardware information (including network devices), software information, and contract information is now available in a database.

Batch collection of files stored in the managed computers is now available.

The user can now suppress the use of the following devices:

Bluetooth devices

Imaging devices

Windows Portable Devices

The user was able to suppress the use of the devices below as removable disks in Windows 8, Windows Server 2012, Windows 7, Windows Server 2008, and Windows Vista. The user can now suppress the use of each type of the following devices:

USB devices

IEEE1394 devices

Internal SD cards

The user can now select whether to obtain a list of files stored in a USB device that are allowed to be used.

The user can now specify whether to display on users' computers the message indicating that the use of a device has been suppressed.

By using the Getting Started Wizard, the user can now manage devices by installing agents on them.

The functionality of the multi-server configuration system was deleted. One management server can now manage up to 30,000 devices.

The user can now set the conditions for collecting operation logs regarding the following operations:

File operations

Startup and stop of programs

Window operations

The user can now collect operation logs for device connection permission.

The user can now set the interval of sending notifications about prohibited-operation suppression events and operation logs to the higher system, and the maximum period the user's computer can retain such events and logs.

The user can now set the number of consecutive login failures allowed before the account is locked, and the number of days until the password expires.

Settings during installation, setup, and agent setup were changed due to the change in the product structure.

Windows 8.1 and Windows Server 2012 R2 were added to the supported OSs for the following products:

JP1/IT Desktop Management 2 - Manager

JP1/IT Desktop Management 2 - Agent

JP1/IT Desktop Management 2 - Network Monitor

JP1/IT Desktop Management 2 - RC Manager

Windows 8 and Windows 7 are now excluded from the supported OSs for the following product:

JP1/IT Desktop Management 2 - Manager

Windows 2000 is now excluded from the supported OSs for the following product:

JP1/IT Desktop Management 2 - Agent

JP1/IT Desktop Management 09-50 or later, and JP1/IT Desktop Management 2 10-50 were added to the versions that can use Remote Control Agent.

A description that the AMT version required to use AMT functions is version 9.5 or earlier was added.

The following products were added to the supported anti-virus products:

Kaspersky Endpoint Security 10 for Windows

Sophos Endpoint Security and Control for Windows

Among the supported anti-virus products, the supported versions of the following products were changed:

Norton AntiVirus

Symantec Endpoint Protection

McAfee SaaS Endpoint Protection

ウイルスバスター クラウド

ウイルスバスター ビジネスセキュリティ

Forefront Client Security

Kaspersky Endpoint Security 10 for Windows

ESET NOD32 Antivirus

F-Secure Client Security

The supported Internet Explorer versions were changed.

The supported MobileIron versions were changed.

Microsoft Cluster Service was deleted from the list of supported cluster software products.

A part of port numbers was changed.

Services and processes were added and changed.

Memory requirements, disk space requirements, and required CPUs were changed.

Collection of print operation logs and suppression of print operations are now unavailable for network shared printers.

SLL was deleted from the security-protected connection methods used for communication with the SMTP server.

The function of enabling SSL communication was deleted from the Active Directory settings.

A description that a fixed IP address must be used for the global IP address of the management server was added.

A description about the following was added: A software name is judged by partial match, and a version is judged by Starts-with match during determination of the prohibited software and mandatory software.

A description about the following was added: Only software that exactly matches the specified software name and version is uninstalled from the Tasks view.

A description about the following was added: If the distributed package has the same name as an existing file in the distribution destination, the access permissions for the existing file is inherited to the distributed package.

A description that the assessment levels in Category Assessment Status and Assessment and # of Target Trend are possibly different was added.

The descriptions of the View and Exclusive connection modes in Agent Configuration for remote control sessions were replaced, and the explanation of determining the connection mode was changed.

A description that OneDrive cannot be used for file transfer in remote control sessions was added.

A description about connectivity with lower versions was added.

Host description was added to the device information that can be collected.

The structure of folders created under JP1/IT Desktop Management 2 - Manager was changed due to a change in the product structure.

(15) Changes in 10-10

(a) Changes in the manual (3021-3-152-30)

By linking with JP1/NETM/NM - Manager, the user can now use JP1/IT Desktop Management to control the network connections monitored by an appliance product on which JP1/NETM/NM is running.

In the Security module and Device module, the user can now create a group that can be used to automatically assign managed computers according to the specified conditions.

The differences in operation windows when administration scopes are assigned were corrected.

The following description was added: To conduct an intensive search for devices in the network by specifying a discovery period, specify 50,000 or less IP addresses in the discovery range.

The explanation of the total free space in the computer information was changed as follows:

A description that the type of logical drive is Local Disk was added to the explanation about the hard disk.

A description that, if the total amount of free space on the local disk exceeds 9,223,372,036,854,775,807 bytes, 9,223,372,036,854,775,807 (bytes) is displayed, was added.

The user can now select whether to display on the user's computer the balloon tip on the JP1/IT Desktop Management icon in Taskbar, and a window for entering user information.

Among the device information that can be obtained from the MDM system, the explanation about the system information was changed. The explanation for when an underscore (_) is used in the host name for MDM server linkage was deleted.

A workaround for the problem that ten IP addresses leased by the DHCP server are reserved by the Remote Access function of RRAS (Routing and Remote Access Service), was added.

The user can now specify whether to enable all automatic updates on the network filter list or to enable automatic updates only for add operations.

Among the supported anti-virus products, the supported versions of the following products were changed:

ウイルスバスター コーポレートエディション

ウイルスバスター コーポレートエディション アドバンス

ウイルスバスター コーポレートエディション サーバ版

ウイルスバスター コーポレートエディション サーバ版 アドバンス

ESET Endpoint Antivirus

ESET File Security for Microsoft Windows Server

OfficeScan Corporate Edition

Also, a note on when the anti-virus product is ServerProtect for Windows NT/NetWare was added.

The minimum values that can be entered for the judgment values in User-Defined Security Settings were added.

A description about the following was added: If version information for the executable file of the target software program is corrupted or contradicted, the program might not be blocked. This might occur even if the Formal file name or Original file name settings in Windows Explorer matches the File name setting for the program.

Firefox was deleted from the Web browsers that can be used to collect operation logs for Web access, upload of files, and download of files.

An explanation about the required conditions for the managed files was added.

A description about the following was added: If the processing is forcibly terminated after operation logs are sent from a computer running an agent to the management server, operation logs might be duplicately collected until the operation logs on that computer are deleted.

A description that operation logs for uploading files might not be collected in Internet Explorer 10 was added.

A description that the access permissions for the distribution-destination folder are inherited to the distributed package was added. Also, a description that the user needs to operate on the distribution-target computer to change the access permissions for the distributed package was added.

The description about reducing the load caused by distribution was corrected.

Notes on distribution were added.

Android was added to the required OSs for smart devices that are managed with linkage with the MDM system.

The description about the versions of the JP1 Smart Device Management service in a MDM linkage configuration system was changed.

When the free space of individual data folders on the site server is insufficient, the following actions might be now taken: Events are output according to the free space size, or a part of the JP1/IT Desktop Management functions is automatically stopped.

The guideline of the disk capacity required for the operation log database was changed.

The guideline of the recommended disk capacity was changed.

The explanation about port setting was corrected. An explanation about the network between JP1/IT Desktop Management - Remote Site Server and an agentless computer was added.

The values that can be specified for the following items in the Settings module were corrected:

Items under Protection settings for registering USB devices of Agent Configuration Items that can be opened from the Agent Configurations view under Agent

Items in the AMT view under Inventory

Items in the Active Directory view under General

Items in the MDM Linkage Settings view under General

The memory usage on the following servers was changed:

Management server in a single-server configuration system

Database server in a multi-server configuration system

(b) Changes in the manual (3021-3-337-10(E))

By linking with Job Management Partner 1/NETM/NM - Manager, the user can now use Job Management Partner 1/IT Desktop Management to control the network connections monitored by an appliance product on which Job Management Partner 1/NETM/NM is installed.

In the Security module and Device module, the user can now create a group that can be used to automatically assign managed computers according to the specified conditions.

In the Software License Status view, software licenses can now be managed for each management software.

Revision history for device information can now be collected.

The information on software licenses and contracts that will be displayed can now be limited according to the administration scope set for the user account.

The differences in operation windows when administration scopes are limited were corrected.

The following description was added: To conduct an intensive search for devices in the network by specifying a discovery period, specify 50,000 or fewer IP addresses in the discovery range.

The following descriptions were added about the maximum number of devices that can be managed in a basic configuration system:

When operation logs are collected: 3,000

When operation logs are not collected but the distribution function is used: 5,000

When operation logs are not collected and the distribution function is not used: 10,000

The following description was added: The Agentless Management (Authentication Successful) icon indicates a device that was successfully authenticated via a Windows administrative share or via SNMP.

For the computer name and computer description in the computer information, descriptions for SNMP authentication and smart devices were added. In addition, the description on the free space for the computer information was changed as follows:

A description stating that the type of logical drive for the hard disk is Local Disk hard disk was added.

The following description was added: If the total amount of free space on the local disk exceeds 9,223,372,036,854,775,807 bytes, 9,223,372,036,854,775,807 (bytes) is displayed.

The following products were added the products for which purchasing status and GUID can be collected as installation software information:

Japanese version of Microsoft Office products

Microsoft Office Access 2003

Microsoft Office Excel 2003

Microsoft Office FrontPage 2003

Microsoft Office Outlook 2003

Microsoft Office Personal Edition 2003

Microsoft Office PowerPoint 2003

Microsoft Office Professional Edition 2003

Microsoft Office Professional Enterprise Edition 2003

Microsoft Office Project Professional 2003

Microsoft Office Project Standard 2003

Microsoft Office Publisher 2003

Microsoft Office Standard Edition 2003

Microsoft Office Visio 2003 Professional

Microsoft Office Visio 2003 Standard

Microsoft Office Word 2003

Japanese versions, English versions, and Chinese versions of Microsoft Office products

Microsoft Access 2013

Microsoft Excel 2013

Microsoft InfoPath 2013

Microsoft Lync 2013

Microsoft Office Professional Plus 2013

Microsoft Office Standard 2013

Microsoft OneNote 2013

Microsoft Outlook 2013

Microsoft PowerPoint 2013

Microsoft Project Professional 2013

Microsoft Project Standard 2013

Microsoft Publisher 2013

Microsoft Visio Professional 2013

Microsoft Visio Standard 2013

Microsoft Word 2013

Notes on software that are only displayed in the Programs and Features list of the Windows Control Panel were added.

The user can now select whether to display on the user's computer the balloon tip on the JP1/IT Desktop Management icon in Taskbar, and a window for entering user information.

In the Settings module, a system administrator can now specify the date and time on which a user can start entering user information.

Groups shown in the menu area that correspond to the layers that have been deleted from department and location definitions can be deleted in a batch.

A description stating the following was removed: When a computer which was authenticated only via SNMP is managed, the computer can be authenticated by specifying Windows administrative shares later.

Among the device information that can be obtained from the MDM system, the explanation about the system information was changed. The explanation for when an underscore (_) is used in the host name for MDM server linkage was deleted.

Notes on remote control were changed.

Cases where exclusive communication settings are required and examples of Exclusive Communication Destination for Access-Denied Devices settings were added. Also, a workaround for the problem that ten IP addresses leased by the DHCP server are reserved by the Remote Access function of RRAS (Routing and Remote Access Service), was added.

A note on when network connection was allowed for a device disconnected from network was added.

Windows 8 and Windows Server 2012 were added as applicable OSs for the following programs:

Job Management Partner 1/IT Desktop Management - Manager

Job Management Partner 1/IT Desktop Management - Remote Site Server

Job Management Partner 1/IT Desktop Management - Network Monitor

The user can now specify whether to enable all automatic updates on the network filter list or to enable automatic updates only for add operations.

A description stating the following was deleted: A network monitor agent must be installed on a computer registered for Exclusive Communication Destination for Access-Denied Devices.

You can now add any security policy regarding security settings on the computer, and judge the security status based on desired judgment conditions.

Descriptions of the supported anti-virus products were changed as follows:

The following products were added as supported anti-virus products:

ESET Endpoint Antivirus (32-bit, 64-bit)

ESET File Security for Microsoft Windows Server (32-bit, 64-bit)

English version of Symantec Endpoint Protection 12.1 (32-bit, 64-bit)

Among the supported anti-virus products, the supported versions of the following products were added:

Japanese version of Forefront Client Security

English version of Forefront Client Security

Among the supported anti-virus products, the supported versions of the following products were changed:

ウイルスバスター コーポレートエディション

ウイルスバスター コーポレートエディション アドバンス

ウイルスバスター コーポレートエディション サーバ版

ウイルスバスター コーポレートエディション サーバ版 アドバンス

Japanese version of Forefront Client Security

OfficeScan Corporate Edition

English version of Forefront Client Security

A description was added stating that when a complete scan is performed on the following products, the last scanned date and time can be collected only when all hard disks, system memory, and startup objects are scanned:

Japanese versions of anti-virus products

- Kaspersky Open Space Security Server (32-bit, 64-bit)

- Kaspersky Open Space Security Workstation (32-bit, 64-bit)

- Kaspersky Endpoint Security 8 for Windows (32-bit, 64-bit)

English versions of anti-virus products

- Kaspersky Open Space Security Server 6.0.4 (32-bit, 64-bit)

- Kaspersky Open Space Security Workstation 6.0.4 (32-bit, 64-bit)

A note on when the anti-virus product is ServerProtect for Windows NT/NetWare was added.

The minimum values that can be entered for the judgment values in User-Defined Security Settings were added.

A description about the following was added: If version information for the executable file of the target software program is corrupted or contradicted, the program might not be blocked. This might occur even if the Formal file name or Original file name settings in Windows Explorer matches the File name setting for the program.

Firefox was removed from the Web browsers from which operation logs for Web accesses, file upload, and file download can be collected.

Windows Internet Explorer 11 was added to the supported web browsers.

Microsoft Office Outlook 2013 and Windows Live Mail 2012 were added to email clients for which operation logs can be collected.

An explanation about the required conditions for the monitored files was added.

A description about the following was added: If the processing is forcibly terminated after operation logs are sent from a computer running an agent to the management server, operation logs might be duplicately collected until the operation logs on that computer are deleted.

A description that operation logs for uploading files might not be collected in Internet Explorer 10 was added.

A description that the access permissions for the distribution-destination folder are inherited to the distributed package was added. Also, a description that the user needs to operate on the distribution-target computer to change the access permissions for the distributed package was added.

The description about reducing the load caused by distribution was corrected.

Notes on distribution were added.

A description stating that, when Job Management Partner 1/IM is linked, error events that occur on managed computers can be monitored on the Job Management Partner 1/IM event console, was changed to include a description that major events can also be monitored.

Definitions of common fields and custom fields can now be exported and imported in a CSV file format.

Prerequisites for computers on which an agent is installed were changed.

Android was added to the required OSs for smart devices that are managed with linkage with the MDM system.

A description was added to indicate that a site server configuration must be used for the following cases:

When operation logs are collected and more than 3,000 devices are managed.

When operation logs are not collected but the distribution function is used and more than 5,000 devices are managed.

A description was added to indicate that the maximum number of devices that can be managed by a single site server is as follows:

When operation logs are collected: 1,000

When operation logs are not collected: 3,000

MobileIron 5.8 was added to MDM systems that can be linked.

When the free space of individual data folders on the site server is insufficient, the following actions might now be taken: Events are output according to the free space size, or some of the JP1/IT Desktop Management functions are automatically stopped.

The guideline of the disk capacity required for the operation log database was changed.

The guideline of the recommended disk capacity was changed.

The explanation about port setting was corrected. An explanation about the network between JP1/IT Desktop Management - Remote Site Server and an agentless computer was added.

The values that can be specified for the following items in the Settings module were corrected:

Items under Protection settings for registering USB devices of Agent Configuration Items that can be opened from the Agent Configurations view under Agent

Items in the AMT view under Inventory

Items in the Active Directory view under General

Items in the MDM Linkage Settings view under General

Memory usage for the following servers were changed:

A management server in a single-server configuration system

A database server in a multi-server configuration system

A description stating the following was deleted: Update confirmation of an agent is automatically performed.

(16) Changes in 10-02

(a) Changes in the manual (3021-3-152-20)

A revision history for the device information can now be acquired.

In the Software License Status view, software licenses can now be managed for each management software.

The information on software licenses and contracts that will be displayed can now be limited according to the administration scope set for the user account.

The table that shows the differences in operation windows when administration scopes are limited was corrected.

Descriptions were added to indicate that a maximum of following number of devices can be managed in a basic configuration system:

When operation logs are collected: 3,000

When operation logs are not collected but the distribution function is used: 5,000

When operation logs are not collected and the distribution function is not used: 10,000

A description stating the following was added: The Agentless Management (Authentication Successful) indicates a device that has undergone successful authentication via a Windows administrative share or via SNMP.

For the computer name and computer description in the computer information, descriptions for SNMP authentication and a smart device were added

The following products are added to products of which purchasing status and GUID can be collected as installation software information:

Microsoft Office Personal Edition 2003

Microsoft Office Professional Edition 2003

Microsoft Office Professional Enterprise Edition 2003

Microsoft Office Professional Plus 2013

Microsoft Office Standard Edition 2003

Microsoft Office Standard 2013

Microsoft Lync 2013

Microsoft Office Access 2003

Microsoft Access 2013

Microsoft Office Excel 2003

Microsoft Excel 2013

Microsoft Office FrontPage 2003

Microsoft InfoPath 2013

Microsoft OneNote 2013

Microsoft Office Outlook 2003

Microsoft Outlook 2013

Microsoft Office PowerPoint 2003

Microsoft PowerPoint 2013

Microsoft Office Project Professional 2003

Microsoft Project Professional 2013

Microsoft Office Project Standard 2003

Microsoft Project Standard 2013

Microsoft Office Publisher 2003

Microsoft Publisher 2013

Microsoft Office Visio 2003 Professional

Microsoft Office Visio 2003 Standard

Microsoft Visio Professional 2013

Microsoft Visio Standard 2013

Microsoft Office Word 2003

Microsoft Word 2013

Notes on software that are only displayed in the Programs and Features list of the Windows Control Panel were added.

In the Settings module, a system administrator can now specify the date and time on which a user can start entering user information.

Groups shown in the menu area that correspond to the layers that have been deleted from department and location definitions can be deleted in a batch

A description stating the following was removed: When a computer which was authenticated only via SNMP is managed, the computer can be authenticated by specifying Windows administrative shares later.

Notes on remote control were changed.

Cases where exclusive communication settings are required and examples of Exclusive Communication Destination for Access-Denied Devices settings were added.

A note on when network connection was allowed for a device disconnected from network was added.

Windows 8 and Windows Server 2012 was added as applicable OSs for the following programs:

JP1/IT Desktop Management - Manager

JP1/IT Desktop Management - Remote Site Server

JP1/IT Desktop Management - Network Monitor

A description stating the following was deleted: A network monitor agent must be installed on a computer registered for Exclusive Communication Destination for Access-Denied Devices.

You can now add any security policy regarding security settings on the computer, and judge the security status based on desired judgment conditions.

The following products were added as supported anti-virus products:

ESET Endpoint Antivirus (32-bit, 64-bit)

ESET File Security for Microsoft Windows Server (32-bit, 64-bit)

A description was added stating that when a complete scan is performed on the following products, the last scanned date and time can be collected only when all hard disks, system memory, and startup objects are scanned:

Japanese versions of anti-virus products

Kaspersky Open Space Security Server (32-bit, 64-bit)

Kaspersky Open Space Security Workstation (32-bit, 64-bit)

Kaspersky Endpoint Security 8 for Windows (32-bit, 64-bit)

English versions of anti-virus products

Kaspersky Open Space Security Server 6.0.4 (32-bit, 64-bit)

Kaspersky Open Space Security Workstation 6.0.4 (32-bit, 64-bit)

Microsoft Office Outlook 2013 and Windows Live Mail 2012 were added to email clients for which operation logs can be collected.

A description stating that, when JP1/IM is linked, error events that occur on managed computers can be monitored on the JP1/IM event console, was changed to include a description that major events can also be monitored.

Definitions of common fields and custom fields can now be exported and imported in a CSV file format.

A description was added to indicate that a site server configuration must be used for the following cases:

When operation logs are collected and more than 3,000 devices are managed.

When operation logs are not collected but distribution function is used and more than 5,000 devices are managed.

A description was added to indicate that the maximum number of devices that can be managed by a single site server is as follows:

When operation logs are collected: 1,000

When operation logs are not collected: 3,000

A description stating the following was deleted: Update confirmation of an agent is automatically performed.

(17) Changes in 10-01

(a) Changes in the manual (3021-3-152-10)

The offline management function can now be used to manage computers that are not connected to the management server via a network.

Information about JP1/IT Desktop Management can now be updated by acquiring support service information including anti-virus product information.

During asset management, the license types, product IDs, and GUIDs of some purchased software products, as well as software types, can now be managed. In addition, to manage software type, information about JP1/IT Desktop Management can now be updated by acquiring support service information including SAMAC software dictionary file for offline updates.

A description stating the following was added: Suspicious file transfer operations and suspicious printing operations are displayed and investigated in different manners.

Differences in the Home module and Assets module when administration scopes are limited were corrected.

Software can now be added to the managed-software list by from the Software Inventory view of the Device module.

Improved the description of the case in which a site server is deployed within the network search range.

A description stating the following was added: To discover networked devices in an environment with site servers deployed, the management server and the site server must be mutually accessible by their IP addresses.

A cautionary note about when a discovery range includes a loop-back address or broadcast address was added.

Windows 8 and Windows Server 2012 were added as applicable OSs for JP1/IT Desktop Management - Agent.

The explanation of the legend of the table indicating the system information that can be acquired from Active Directory was improved.

A description stating the following was added: SNMP: NG(No credential) might appear if not enough information was collected to identify a device.

The Host Name entry was added in the computer information that can be collected as system information.

A description stating that the Workstation service of the OS of a managed computer must be running to collect the following information was added:

Automatic Windows Update in Windows Update Details

Windows Service Details

OS Security Details

The description of Registered Date/Time shown on the Installed Computers tab was corrected.

The conditions that must be met to control the power status of a computer were corrected.

The time when the computer is restarted can now be set in the Add Agent Configuration dialog box and the Edit Agent Configuration dialog box. Accordingly, the descriptions of the Shutdown Computer and Computer Restart settings dialog boxes that appear on a computer with the agent installed were changed.

Notes on when the discovery range or authentication information for any agentless managed device is deleted, or Active Directory setting for any agentless managed device is deleted were converged into 4.2.7.

Whether system information can be collected from an MDM system was added. The explanation of the legend was improved.

A description stating the following was added: When you use the remote control feature, if there is no mouse connected to a computer with the agent installed, the mouse pointer will always be shaped as an arrow regardless of context.

A description of how to specify the settings to control network connections so that newly discovered devices are automatically permitted to connect to the network was added.

The settings you need to enter in the network control list for devices used in particular ways were added.

A description stating that the computers for which network monitor is enabled are not judged for Windows firewall was added.

The following products were added as supported anti-virus products:

Norton AntiVirus (32-bit, 64-bit)

ウイルスバスター クラウド (32-bit, 64-bit)

ウイルスバスター ビジネスセキュリティ 7.0 (32-bit, 64-bit)

Kaspersky Endpoint Security 8 for Windows 8.1 (32-bit, 64-bit)

ESET NOD32 Antivirus 5.2 (32-bit, 64-bit)

F-Secure Client Security 9.32 (32-bit, 64-bit)

Notes on configuring security policy were converged into 2.9.4(2). Also, a note that applies when a security policy (for which Block Printing or Acquisition of Operations Logs is set) is assigned to a computer, and actions to be taken were added.

A note that applies when both JP1/IT Desktop Management and another program restrict startup of the same software program was corrected.

A note that applies when Restrict reading/writing is enabled for USB devices in a security policy was added.

A condition on which update programs are automatically acquired from Microsoft website and distributed was corrected.

Notes on configuring operation log collection were converged into 2.10.8(1). Also, a note on computers running a 64-bit edition of an OS and with VMWare Server installed was added.

Windows Internet Explorer 10 and Firefox 5 were added as Web browsers for which operation logs can be acquired.

The description of Original File Created Date/Time acquired in an operation log was corrected.

The note on the recreatelogdb command was corrected.

It is now stated that ReFS is also applicable to the notes on acquiring source information of incoming files when files are moved or copied to a drive that uses a file system other than NTFS.

The description of how devices and hardware assets are identified was corrected.

Information about unconfirmed software can now be displayed in the Software Inventory view of the Device module.

A description stating the following was added: Computers with the network monitor enabled cannot be configured in a cluster configuration.

The description of a server on which the ioutils exportoplog command can be executed was corrected.

A note for users operating a computer was added.

Windows Internet Explorer 10 was added as a software product required for a computer on which the agent will be installed.

The site server prerequisites were corrected.

The prerequisites for a computer on which the network monitor is enabled were corrected.

The prerequisites for linking with JP1/IM were added.

A description on the versions of the JP1 Smart Device Management service that can be linked were changed.

The maximum disk space requirements are now separately described for the management server in a single-server configuration system, for the management server and database server in a multi-server configuration system, and for a site server.

The list of services was changed as described below.

The JP1/IT Desktop Management - Manager services and the site server services were described separately.

Descriptions of the network monitor services and agent services were added.

An entry showing whether the service starts automatically was added.

An entry showing whether the process is resident was added to the list of processes.

The port numbers used for JP1/IT Desktop Management - Manager were described separately for a single-server configuration and for a multi-server configuration.

Descriptions of the values set for the setup parameters and agent setting parameters when JP1/IT Desktop Management is upgraded from a version 10-00 or earlier were added.

In accordance with the addition of the following event numbers, the range of values that can be specified for events not subject to notification was changed to 0 to 1124.

1117, 1118, 1123, 1124

The host name of the MDM server automatically entered with linkage with the JP1 Smart Device Management service was changed to www.jp1sdm.hitachi.jp.

The default value of the start time of the acquisition schedule that can be specified in the MDM linkage settings was changed to (Blank).

Memory requirements for each system component of the product were changed.

Disk space requirements for each system component of the product were changed.

Prerequisite CPUs for each system component of the product were changed.

The list of limit values was updated.

The description of automatically obtaining information from an MDM system and the time at which information is collected were corrected.

A description of the Windows menu names used in this manual was added.

(b) Changes in the manual (3021-3-337(E))

The offline management function can now be used to manage computers that are not connected to the management server via a network.

Information about JP1/IT Desktop Management can now be updated by acquiring the support service information.

During asset management, the license types, product IDs, and GUIDs of some purchased software products can now be managed.

A description stating the following was added: Suspicious file transfer operations and suspicious printing operations are displayed and investigated in different manners.

Differences in the Home module and Assets module when administration scopes are limited were corrected.

Software can now be added to the managed-software list by using the Software Inventory view of the Device module

The description of the case in which a site server is deployed within the network search range was improved.

A description stating the following was added: To discover networked devices in an environment with site servers deployed, the management server and the site server must be mutually accessible by their IP addresses.

A cautionary note about when a discovery range includes a loop-back address or broadcast address was added.

Windows 8 and Windows Server 2012 were added as applicable OSs for JP1/IT Desktop Management - Agent.

The explanation of the legend of the table indicating the system information that can be acquired from Active Directory was improved.

A description stating the following was added: SNMP: NG(No credential) might appear if not enough information was collected to identify a device.

The Host Name entry was added in the computer information that can be collected as system information.

A description stating that the Workstation service of the OS of a managed computer must be running to collect the following information was added:

Automatic Windows Update in Windows Update Details

Windows Service Details

OS Security Details

The description of Registered Date/Time shown on the Installed Computers tab was corrected.

The conditions that must be met to control the power status of a computer were corrected.

The time when the computer is restarted can now be set in the Add Agent Configuration dialog box and the Edit Agent Configuration dialog box. Accordingly, the descriptions of the Shutdown Computer and Computer Restart settings dialog boxes that appear on a computer with the agent installed were changed.

Whether system information can be collected from an MDM system was added. The explanation of the legend was improved.

A description stating the following was added: When you use the remote control feature, if there is no mouse connected to a computer with the agent installed, the mouse pointer will always be shaped as an arrow regardless of context.

A description of how to specify the settings to control network connections so that newly discovered devices are automatically permitted to connect to the network was added.

The settings you need to enter in the network control list for devices used in particular ways were added.

A description stating that the computers for which network monitor is enabled are not judged for Windows firewall was added.

The following products were added as supported anti-virus products:

Norton AntiVirus 2012 (32-bit, 64-bit)

Norton AntiVirus (32-bit, 64-bit)

ウイルスバスター 2012 クラウド (32-bit, 64-bit)

ウイルスバスター クラウド (32-bit, 64-bit)

ウイルスバスター コーポレートエディション 10.6 (32-bit, 64-bit)

ウイルスバスター ビジネスセキュリティ 7.0 (32-bit, 64-bit)

Kaspersky Endpoint Security 8 for Windows 8.1 (32-bit, 64-bit)

Kaspersky Endpoint Security 8 for Windows (32-bit, 64-bit)

ESET NOD32 Antivirus 5.0 (32-bit, 64-bit)

ESET NOD32 Antivirus 5.2 (32-bit, 64-bit)

Sophos Endpoint Protection - Enterprise 10 (32-bit, 64-bit)

Sophos Endpoint Protection - Advanced 10 (32-bit, 64-bit)

Sophos Endpoint Protection - Basic 10 (32-bit, 64-bit)

F-Secure Client Security 9.11 (32-bit, 64-bit)

F-Secure Client Security 9.20 (32-bit, 64-bit)

F-Secure Client Security 9.31 (32-bit, 64-bit)

F-Secure Client Security 9.32 (32-bit, 64-bit)

The following products were removed from the supported anti-virus products:

ウイルスバスター 2010 (32-bit, 64-bit)

F-Secure Client Security 8.01 (32-bit, 64-bit)

A note that applies when a security policy (for which Block Printing or Acquisition of Operations Logs is set) is assigned to a computer, and actions to be taken were added.

A note that applies when both JP1/IT Desktop Management and another program restrict startup of the same software program was added.

A note that applies when Restrict reading/writing is enabled for USB devices in a security policy was added.

A note on operation log collection configuration on computers running a 64-bit edition of an OS and with VMWare Server installed was added.

Windows Internet Explorer 10 and Firefox 5 were added as Web browsers for which operation logs can be acquired.

The description of Original File Created Date/Time acquired in an operation log was corrected.

The note on the recreatelogdb command was corrected.

It is now stated that ReFS is also applicable to the notes on acquiring source information of incoming files when files are moved or copied to a drive that uses a file system other than NTFS.

The description of how devices and hardware assets are identified was corrected.

Information about unconfirmed software can now be displayed in the Software Inventory view of the Device module.

A description stating the following was added: Computers with the network monitor enabled cannot be configured in a cluster configuration.

The description of a server on which the ioutils exportoplog command can be executed was corrected.

A note for users operating a computer was added.

Windows Internet Explorer 10 was added as a software product required for a computer on which the agent will be installed.

The site server prerequisites were corrected.

The prerequisites for a computer on which the network monitor is enabled were corrected.

The prerequisites for linking with JP1/IM were added.

The maximum disk space requirements are now separately described for the management server in a single-server configuration system, for the management server and database server in a multi-server configuration system, and for a site server.

The list of services was changed as described below.

The JP1/IT Desktop Management - Manager services and the site server services were described separately.

Descriptions of the network monitor services and agent services were added.

An entry showing whether the service starts automatically was added.

An entry showing whether the process is resident was added to the list of processes.

The port numbers used for JP1/IT Desktop Management - Manager were described separately for a single-server configuration and for a multi-server configuration.

Descriptions of the values set for the setup parameters and agent setting parameters when JP1/IT Desktop Management is upgraded from a version 09-50 or earlier were added.

In accordance with the addition of the following event numbers, the range of values that can be specified for events not subject to notification was changed to 0 to 1123.

1117, 1118, 1123

The default value of the start time of the acquisition schedule that can be specified in the MDM linkage settings was changed to (Blank).

Memory requirements for each system component of the product were changed.

Disk space requirements for each system component of the product were changed.

Prerequisite CPUs for each system component of the product were changed.

The list of limit values was updated.

The description of automatically obtaining information from an MDM system and the time at which information is collected were corrected.

A description of the Windows menu names used in this manual was added.

A maximum of 50,000 devices can now be managed by using a multi-server configuration system.

The information that will be displayed and operations that can be performed can now be limited according to the task allocation set for the user account.

Suppression of only writes is now possible for floppy drives and removable disks.

JP1 event can now be reported by linkage with JP1/IM.

A description was added stating that the root OU settings in the information about connections to Active Directory domains are not case sensitive.

A description of the LDAP attribute name used for obtaining information such as Department, Country, and State from Active Directory was added.

A description stating the following was added: If security countermeasures are automatically enforced, you cannot change the settings of the managed computers back to the state before the countermeasures were taken even if you use the JP1/IT Desktop Management functions.

The following notes on network monitoring were added:

Notes on the Routing and Remote Access service

A wired LAN connection is recommended for computers for which the network monitor is enabled.

A mission-critical server, such as a file server, should not be configured as the network monitoring computer with network monitor enabled.

A note on using a DHCP server to monitor the network in which IP addresses are dynamically allocated

A description about when a network control list is updated was added.

A description stating the following was added: Maintenance of a network control list is performed automatically when device information is updated or deleted.

A description stating the following was added: The devices disconnected from the network by the network monitor can only communicate with computers with the network monitor enabled in the network segment or computers registered for Exclusive Communication Destination for Access-Denied Devices.

Descriptions of monitoring targets for the network monitor feature, including the networks, OSs on monitored computers, and protocols, were added.

A description stating the following was added: If a device discovered by the monitor feature is deleted, the device will not be discovered again unless it is disconnected and then reconnected to the network.

A description stating the following was added: A list populated with a MAC address and associated with a device can no longer be deleted from the network control list.

A description stating the following was added: Site servers are automatically registered for Exclusive Communication Destination for Access-Denied Devices.

A description stating the following was added: If a network monitor agent is installed, the service is automatically enabled and the firewall settings are automatically disabled.

A description stating the following was added: Serial numbers that can be used as mapping keys during imports are serial numbers specified in BIOS information.

A description stating the following was added: Installation and uninstallation of software by using the distribution function are performed with local system account permissions.

A description stating the following was added: If a connection between a computer and a management server fails, operation logs are temporarily saved in the computer.

A description stating the following was added: When you delete devices from the network control list, information for the devices with Permit specified for network connection is also deleted from the network control list. However, information for the devices with Not Permit specified remains in the list.

A description stating the following was added: Servers on which Citrix XenApp or Windows terminal service is installed cannot be managed even if you install an agent.

The description of the devices for which Windows administrative shares or SNMP authentication cannot be used was changed.

A description stating the following was added: The Workstation service of the OS must be running on a computer on which an agent will be installed.

A note was added on performance degradation in printer servers and network in an environment in which a network shared printer has been registered on a computer on which an agent will be installed.

The following descriptions about agentless management were added:

Notes on using agentless management

When device information is collected

When executable programs for acquiring device information are sent

Settings necessary for managing agentless computers

The settings required to acquire device information from agentless devices when Windows Administrative Share is enabled in Windows 7, Windows Vista, and Windows Server 2008 were changed.

A description stating the following was added: If you delete a hardware asset for which Asset Status is Unconfirmed, the device is deleted from the Device Inventory view of the Device module.

A description stating the following was added: A virtual environment configured by combining VMware vSphere and VMware View is not supported.

A description of how to set the user permissions required for remote control using Windows authentication was added.

A description stating the following was added: Devices manually registered in the network control list can also be deleted from the network control list.

A description stating the following was added: Devices that must always be connected to the network must be registered in the network control list as the devices permitted for network connection.

The following were added as timings when network connection is automatically updated: when the device information was updated or deleted; when the network connection device information was changed.

The descriptions of information and the judgement conditions used for judgement of unauthorized software and unauthorized Windows service were corrected.

Descriptions of user accounts not subject to security judgement were added.

The description of Other Access Restrictions in the items that can be set for security policies was corrected.

Supplementary notes on external media for which operation can be suppressed for each OS were added.

Prerequisites for acquiring the following types of operation logs were changed:

Start and termination of programs

File and folder operations

Web accesses

A description stating the following was added: Operation logs for file deletion might not be acquired depending on the method of deleting the file.

Descriptions of the operation log information that is acquired when the user performs an undo operation (using the keyboard or Undo menu item) were added.

A description of the Content-type of MIME header of email that is not handled as an attached file was added to the notes on operation logs acquired by sending and receiving emails.

A description of the case in which files are moved or copied to a drive formatted by using other than NTFS, such as a FAT Drive, was added to the notes on acquiring source information of incoming files.

The CSV file coding format for importing the following hardware asset information was changed:

Memory

Storage capacity

Free storage capacity

Display size

The recommended disk space was corrected. The recommended disk space values when only operation logs related to suspicious operations are collected on the site server were added.

A description stating the following was added: To distribute packages to many devices, distribute them in several batches or use site servers.

The ioutils exportdevice command can now be used to export device information.

The ioutils exportdevicedetail command can now be used to export detailed device information.

The balloon tip message that appears when you apply a security policy that requires restarting of the computer was changed.

Network connection environments for each system component were added to the network prerequisites.

The condition required to use an RFB connection for starting a remote control session was changed. In addition, a caution stating that operation is not always guaranteed for remote control using the RFB connection was added.

Descriptions of the system environment for using a site server configuration and the number of devices that can be managed by a single site server were added.

mgr\definition was added as a folder that is created under the installation folder.

The explanations of automatic execution of the following functions and when they are executed were corrected:

Collecting user information

Regularly checking and updating support information

Updating Scan Engine Version and Virus Definition File Version settings for anti-virus products

The descriptions in the list of processes were corrected.

Smart devices can now be managed by linkage with an MDM service.

The total number of installed devices (number of used licenses) is now displayed in managed software information.

The information that will be displayed and operations that can be performed can now be limited according to the administration scope set for the user account.

A description stating the following was added: Agentless devices cannot be managed in a NAT environment.

A description stating the following was added: You cannot use the network monitor feature to detect devices in network segments that are not directly accessible from the management server.

A description stating the following was added: You can monitor multiple network segments from one computer on which the network monitor is enabled and the agent is installed if the computer has access to several networks through a number of network cards.

Windows Server 2008 R2 Datacenter was added in the prerequisites for a management server, computers on which an agent will be installed, and site servers.

A description of the confirmation method when software is added to a managed computer was added.

A description of how departments and locations are defined was added. The name of a department and location can now be changed from the menu area.

A description stating the following was added: By configuring event notification by email, you can have the administrator notified by email when a network connection is blocked or permitted.

A description stating the following was added: If access to removable disks is suppressed, the use of USB-connected removable disks is not permitted even if they are registered as hardware assets.

A description stating the following was added: You can use automatic update distribution based on security policies and the Windows automatic update function (Windows Update and Microsoft Update).

If multiple instances of a managed software product are installed on one computer, they are now counted as one license used.

A description stating the following was added: If hyphens (-) are displayed in the information area, they are replaced by null strings when exported.

A description of the types of software that can be uninstalled by using the distribution function was added.

A command can now be used to delete operation logs on a site server.

Windows 7 was added in perquisites for computers for which the network monitor is enabled.

The description of network prerequisites was improved.

A description stating the following was added: The site servers specified to store operation logs must be placed in the same network segment as the management server in a NAT environment.

The guidelines for the required disk space for backing up operation logs for one year were changed.

The guidelines for the recommended disk space for all data (including operation logs) managed by JP/IT Desktop Management were changed.

Port number 31000 was added to the list of port numbers for site servers.

Descriptions of the rules for setting a user account password were added.

A description stating the following was added: If a domain user is authenticated by a Windows administrative share, the user ID must be in user-ID@FQDN (FQDN: fully qualified domain name) or in domain-name\user-ID format.

A description stating the following was added: For custom installation, at least 20 GB of disk space is required on the database storage folder drive to acquire operation logs.

(18) Changes in 10-00

(a) Changes in the manual (3021-3-152)

A maximum of 50,000 devices can now be managed by using a multi-server configuration system.

The information that will be displayed and operations that can be performed can now be limited according to the task allocation set for the user account.

Suppression of only writes is now possible for floppy drives and removable disks.

Smart devices can now be managed by linkage with an MDM service.

JP1 events can now be reported by linkage with JP1/IM.

The following products were added to the supported anti-virus products:

Norton AntiVirus 2012 (32-bit, 64-bit)

ウイルスバスター 2012 クラウド (32-bit, 64-bit)

ウイルスバスター コーポレートエディション 10.6 (32-bit, 64-bit)

ESET NOD32 Antivirus 5.0 (32-bit, 64-bit)

Sophos Endpoint Protection - Enterprise 10 (32-bit, 64-bit)

Sophos Endpoint Protection - Advanced 10 (32-bit, 64-bit)

Sophos Endpoint Protection - Basic 10 (32-bit, 64-bit)

Kaspersky Endpoint Security 8 for Windows (32-bit, 64-bit)

F-Secure Client Security 9.11 (32-bit, 64-bit)

F-Secure Client Security 9.20 (32-bit, 64-bit)

F-Secure Client Security 9.31 (32-bit, 64-bit)

In addition, the following products were removed from the supported anti-virus products:

ウイルスバスター 2010 (32-bit, 64-bit)

F-Secure Client Security 8.01 (32-bit, 64-bit)

A description was added stating that the root OU settings in the information about connections to Active Directory domains are not case sensitive.

A description of the LDAP attribute name used for obtaining information such as Department, Country, and State from Active Directory was added.

A description stating the following was added: If security countermeasures are automatically enforced, you cannot change the settings of the managed computers back to the state before the countermeasures were taken even if you use the JP1/IT Desktop Management functions.

The following notes on network monitoring were added:

Notes on the Routing and Remote Access service

A wired LAN connection is recommended for computers for which the network monitor is enabled.

A mission-critical server, such as a file server, should not be configured as the network monitoring computer with network monitor enabled.

A note on using a DHCP server to monitor the network in which IP addresses are dynamically allocated

A description about when a network control list is updated was added.

A description stating the following was added: Update of a network control list is performed automatically when device information is updated or deleted.

A description stating the following was added: The devices disconnected from the network by the network monitor can only communicate with computers with the network monitor enabled in the network segment or computers registered for Exclusive Communication Destination for Access-Denied Devices.

Descriptions of monitoring targets for the network monitor feature, including the networks, OSs on monitored computers, and protocols, were added.

A description stating the following was added: If a device discovered by the monitor feature is deleted, the device will not be discovered again unless it is disconnected and then reconnected to the network.

A description stating the following was added: A list populated with a MAC address and associated with a device can no longer be deleted from the network control list.

A description stating the following was added: Site servers are automatically registered for Exclusive Communication Destination for Access-Denied Devices.

A description stating the following was added: If a network monitor agent is installed, the service is automatically enabled and the firewall settings are automatically disabled.

A description stating the following was added: Serial numbers that can be used as mapping keys during imports are serial numbers specified in BIOS information.

A description stating the following was added: Installation and uninstallation of software by using the distribution function are performed with local system account permissions.

A description stating the following was added: If a connection between a computer and a management server fails, operation logs are temporarily saved in the computer.

A description stating the following was added: When you delete devices from the network control list, information for the devices with Permit specified for network connection is also deleted from the network control list. However, information for the devices with Not Permit specified remains in the list.

A description stating the following was added: Servers on which Citrix XenApp or Windows terminal service is installed cannot be managed even if you install an agent.

The description of the devices for which Windows administrative shares or SNMP authentication cannot be used was changed.

A description stating the following was added: The Workstation service of the OS must be running on a computer on which an agent will be installed.

A note was added on performance degradation in printer servers and network in an environment in which a network shared printer has been registered on a computer on which an agent will be installed.

The following descriptions about agentless management were added:

Notes on using agentless management

When device information is collected

When executable programs for acquiring device information are sent

Settings necessary for managing agentless computers

The settings required to acquire device information from agentless devices when Windows Administrative Share is enabled in Windows 7, Windows Vista, and Windows Server 2008 were changed.

A description stating the following was added: If you delete a hardware asset for which Asset Status is Unconfirmed, the device is deleted from the Device Inventory view of the Device module.

A description stating the following was added: A virtual environment configured by combining VMware vSphere and VMware View is not supported.

A description of how to set the user permissions required for remote control using Windows authentication was added.

A description stating the following was added: Devices manually registered in the network control list can also be deleted from the network control list.

A description stating the following was added: Devices that must always be connected to the network must be registered in the network control list as the devices permitted for network connection.

The following were added as timings when network connection is automatically updated: when the device information was updated or deleted; when the network connection device information was changed.

The descriptions of information and the judgement conditions used for judgement of unauthorized software and unauthorized Windows service were corrected.

Descriptions of user accounts not subject to security judgement were added.

The description of Other Access Restrictions in the items that can be set for security policies was corrected.

Supplementary notes on external media for which operation can be suppressed for each OS were added.

Prerequisites for acquiring the following types of operation logs were changed:

Start and termination of programs

File and folder operations

Web accesses

A description stating the following was added: Operation logs for file deletion might not be acquired depending on the method of deleting the file.

Descriptions of the operation log information that is acquired when the user performs an undo operation (using the keyboard or Undo menu item) were added.

A description of the Content-type of MIME header of email that is not handled as an attached file was added to the notes on operation logs acquired by sending and receiving emails.

A description of the case in which files are moved or copied to a drive formatted by using other than NTFS, such as a FAT Drive, was added to the notes on acquiring source information of incoming files.

The CSV file coding format for importing the following hardware asset information was changed:

Memory

Storage capacity

Free storage capacity

Display size

The recommended disk space was corrected. The recommended disk space values when only operation logs related to suspicious operations are collected on the site server were added.

A description stating the following was added: To distribute packages to many devices, distribute them in several batches or use site servers.

The ioutils exportdevice command can now be used to export device information.

The ioutils exportdevicedetail command can now be used to export detailed device information.

The balloon tip message that appears when you apply a security policy that requires restarting of the computer was changed.

Network connection environments for each system component were added to the network prerequisites.

The condition required to use an RFB connection for starting a remote control session was changed. In addition, a caution stating that operation is not always guaranteed for remote control using the RFB connection was added.

Descriptions of the system environment for using a site server configuration and the number of devices that can be managed by a single site server were added.

mgr\definition was added as a folder that is created under the installation folder.

The explanations of automatic execution of the following functions and when they are executed were corrected:

Collecting user information

Regularly checking and updating support information

Updating Scan Engine Version and Virus Definition File Version settings for anti-virus products

CF was added to the list of acronyms used in this manual.

The descriptions in the list of processes were corrected.

(19) Changes in 09-51

(a) Changes in the manual (3020-3-S93-10)

Smart devices can now be managed by linkage with an MDM service.

The total number of installed devices (number of used licenses) is now displayed in managed software information.

The information that will be displayed and operations that can be performed can now be limited according to the administration scope set for the user account.

A description stating the following was added: Agentless devices cannot be managed in a NAT environment.

A description stating the following was added: You cannot use the network monitor feature to detect devices in network segments that are not directly accessible from the management server.

A description stating the following was added: You can monitor multiple network segments from one computer on which the network monitor is enabled and the agent is installed if the computer has access to several networks through a number of network cards.

Windows Server 2008 R2 Datacenter was added in the prerequisites for a management server, computers on which an agent will be installed, and site servers.

A description of the confirmation method when software is added to a managed computer was added.

A description of how departments and locations are defined was added. The name of a department and location can now be changed from the menu area.

A description stating the following was added: By configuring event notification by email, you can have the administrator notified by email when a network connection is blocked or permitted.

A description stating the following was added: If access to removable disks is suppressed, the use of USB-connected removable disks is not permitted even if they are registered as hardware assets.

A description stating the following was added: You can use automatic update distribution based on security policies and the Windows automatic update function (Windows Update and Microsoft Update).

If multiple instances of a managed software product are installed on one computer, they are now counted as one license used.

A description stating the following was added: If hyphens (-) are displayed in the information area, they are replaced by null strings when exported.

A description of the types of software that can be uninstalled by using the distribution function was added.

A command can now be used to delete operation logs on a site server.

Windows 7 was added in perquisites for computers for which the network monitor is enabled.

The description of network prerequisites was improved.

A description stating the following was added: The site servers specified to store operation logs must be placed in the same network segment as the management server in a NAT environment.

The guidelines for the required disk space for backing up operation logs for one year were changed.

The guidelines for the recommended disk space for all data (including operation logs) managed by JP/IT Desktop Management were changed.

Port number 31000 was added to the list of port numbers for site servers.

Descriptions of the rules for setting a user account password were added.

A description stating the following was added: If a domain user is authenticated by a Windows administrative share, the user ID must be in user-ID@FQDN (FQDN: fully qualified domain name) or in domain-name\user-ID format.

Changes were made to required amounts of memory for a management server, a computer on which the operation window is displayed, and a computer on which network monitor is enabled.

A description stating the following was added: For custom installation, at least 20 GB of disk space is required on the database storage folder drive to acquire operation logs.

A.15 Miscellaneous information for this manual

(1) Related manuals

JP1 Version 12 Asset and Distribution Management: Getting Started (3021-3-E11(E))

JP1 Version 12 JP1/IT Desktop Management 2 Overview and System Design Guide (3021-3-E12(E))

JP1 Version 12 JP1/IT Desktop Management 2 Configuration Guide (3021-3-E13(E))

JP1 Version 12 JP1/IT Desktop Management 2 Administration Guide (3021-3-E14(E))

JP1 Version 12 JP1/IT Desktop Management 2 Distribution Function Administration Guide (3021-3-E15(E))

JP1 Version 12 JP1/IT Desktop Management 2 - Asset Console Configuration and Administration Guide (3021-3-E16(E))

JP1 Version 12 JP1/IT Desktop Management 2 - Asset Console Creating an Access Definition File Guide (3021-3-E17(E))

JP1 Version 12 JP1/IT Desktop Management 2 Messages (3021-3-E18(E))

JP1 Version 12 JP1/IT Desktop Management 2 - Smart Device Manager (3021-3-E21(E))

JP1 Version 12 JP1/IT Desktop Management 2 - Agent Description and User's Guide (For UNIX Systems) (3021-3-E22(E))

JP1 Version 12 JP1/HIBUN Installation and Setup (for Administrators) (3021-3-E29(E))

JP1 Version 12 JP1/HIBUN Operations (for Administrators) (3021-3-E30(E))

JP1 Version 12 JP1/HIBUN Command Reference (for Administrators) (3021-3-E33(E))

(2) Related publications

JP1/IT Desktop Management 2 Online Help

(3) Abbreviations for product names

Windows menu names used in this manual assume the operating systems shown below.

For management servers, computers for which the network monitor is enabled, and computers on which the controller is installed:

Windows Server 2012

For computers on which an agent is installed:

Windows 7

The Start menu is not displayed in Windows Server 2019, Windows Server 2016, Windows 8.1, Windows 8, and Windows Server 2012. Open the Start window in the bottom left corner of the desktop, and then select the menu.

This manual uses the following abbreviations for product names.

Abbreviation

Full name or meaning

AMT

Intel(R) Active Management Technology

Chrome

Google Chrome

Citrix XenApp

Citrix XenApp(R)

Citrix Virtual Apps

Firefox

Firefox(R)

GWS

Google Workspace

Linux

Linux(R)

Mac

Mac OS

OS X 10.10

OS X 10.11

macOS 10.12

macOS 10.13

macOS 10.14

macOS 10.15

macOS 11

macOS 12

macOS 13

macOS 14

macOS 15

NetWare

NetWare(R)

Pentium

Intel Pentium(R)

VMWare

VMWare(R)

Asset Console

JP1/IT Desktop Management 2 - Asset Console

JP1/AJS

JP1/Automatic Job Management System 2

JP1/Automatic Job Management System 3

JP1/IM

JP1/IM - Manager

JP1/Integrated Management - Manager

JP1/Integrated Management 2 - Manager

JP1/IM - View

JP1/Integrated Management - View

JP1/Integrated Management 2 - View

JP1/IT Desktop Management 2

JP1/IT Desktop Management 2 - Manager

JP1/IT Desktop Management 2 - Operations Director

JP1/NETM/NM

JP1/NETM/Network Monitor

Hibun

JP1/Hibun IC

JP1/秘文 Advanced Edition Information Cypher

JP1/Hibun IF

JP1/秘文 Advanced Edition Information Fortress

JP1/Hibun IF Mail Option

JP1/秘文 Advanced Edition Information Fortress Mail Option

JP1/Hibun IS

JP1/秘文 Advanced Edition Information Share

Hibun IC

HIBUN Advanced Edition Information Cypher

Hibun IF

HIBUN Advanced Edition Information Fortress

Hibun IF Mail Option

HIBUN Advanced Edition Information Fortress Mail Option

Hibun IS

HIBUN Advanced Edition Information Share

Hibun DC

JP1/秘文 Device Control

HIBUN Device Control

Hibun DE

JP1/秘文 Data Encryption

HIBUN Data Encryption

Hibun DP

JP1/秘文 Data Protection

HIBUN Data Protection

This manual uses the following abbreviations for function names.

Abbreviations

Full name

Programs and Features

Add/Remove Programs

Add/Remove Programs

Programs and Features

This manual uses the following abbreviations for Microsoft product names.

Abbreviations

Full name or meaning

Active Directory

Microsoft(R) Active Directory

Internet Explorer

Windows Internet Explorer

Windows(R) Internet Explorer(R)

Microsoft.NET

Microsoft(R).NET

Microsoft Cluster Service

Microsoft(R) Cluster Service

Microsoft Edge

Microsoft(R) Edge

Microsoft Excel

Microsoft(R) Excel(R)

Microsoft Office Excel

Microsoft(R) Office Excel(R)

Microsoft Forefront

Microsoft(R) Forefront(TM)

Microsoft Internet Information Services or IIS

Microsoft(R) Internet Information Services

Microsoft Lync

Microsoft(R) Lync

Microsoft Office

Microsoft(R) Office

Microsoft Office Access

Microsoft(R) Office Access(R)

Microsoft Office InfoPath

Microsoft(R) Office InfoPath(R)

Microsoft Office OneNote

Microsoft(R) Office OneNote

Microsoft Office Outlook

Microsoft(R) Office Outlook(R)

Microsoft Outlook

Microsoft Office PowerPoint

Microsoft(R) Office PowerPoint(R)

Microsoft Office Project

Microsoft(R) Office Project

Microsoft Office Publisher

Microsoft(R) Office Publisher

Microsoft Office Visio

Microsoft(R) Office Visio(R)

Microsoft OneNote

Microsoft(R) OneNote

Microsoft Outlook Express

Microsoft(R) Outlook(R) Express

Microsoft Project

Microsoft(R) Project

Microsoft Publisher

Microsoft(R) Publisher

Microsoft Visio

Microsoft(R) Visio(R)

Microsoft InfoPath

Microsoft(R) InfoPath(R)

MS-DOS

Microsoft(R) MS-DOS(R)

Windows

Windows 2000

Windows 2000 Advanced Server

Microsoft(R) Windows(R) 2000 Advanced Server Operating System

Windows 2000 Professional

Microsoft(R) Windows(R) 2000 Professional Operating System

Windows 2000 Server

Microsoft(R) Windows(R) 2000 Server Operating System

Windows 7

Windows 7 Enterprise

Microsoft(R) Windows(R) 7 Enterprise

Windows 7 Home Basic

Microsoft(R) Windows(R) 7 Home Basic

Windows 7 Home Premium

Microsoft(R) Windows(R) 7 Home Premium

Windows 7 Professional

Microsoft(R) Windows(R) 7 Professional

Windows 7 Starter

Microsoft(R) Windows(R) 7 Starter

Windows 7 Ultimate

Microsoft(R) Windows(R) 7 Ultimate

Windows 8

Windows 8

Windows(R) 8

Windows 8 Enterprise

Windows(R) 8 Enterprise

Windows 8 Pro

Windows(R) 8 Pro

Windows 8.1

Windows 8.1

Windows(R) 8.1

Windows 8.1 Enterprise

Windows(R) 8.1 Enterprise

Windows 8.1 Pro

Windows(R) 8.1 Pro

Windows 10

Windows 10 Enterprise

Windows(R) 10 Enterprise

Windows 10 Pro

Windows(R) 10 Pro

Windows 10 Enterprise multi-session

Windows(R) 10 Enterprise multi-session

Windows 11

Windows 11 Enterprise

Windows(R) 11 Enterprise

Windows 11 Enterprise multi-session

Windows(R) 11 Enterprise multi-session

Windows 11 Pro

Windows(R) 11 Pro

Windows 11 Pro for Workstation

Windows(R) 11 Pro for Workstation

Windows Server 2003

Windows Server 2003#

Windows Server 2003 Enterprise Edition

Microsoft(R) Windows Server(R) 2003, Enterprise Edition

Windows Server 2003 Standard Edition

Microsoft(R) Windows Server(R) 2003, Standard Edition

Windows Server 2003 Enterprise

Microsoft(R) Windows Server(R) 2003, Enterprise x64 Edition

Windows Server 2003 Standard

Microsoft(R) Windows Server(R) 2003, Standard x64 Edition

Windows Server 2003 R2

Microsoft Windows Server 2003 R2 Enterprise

Microsoft(R) Windows Server(R) 2003 R2, Enterprise Edition

Microsoft Windows Server 2003 R2 Standard

Microsoft(R) Windows Server(R) 2003 R2, Standard Edition

Microsoft Windows Server 2003 R2 Enterprise

Microsoft(R) Windows Server(R) 2003 R2, Enterprise x64 Edition

Microsoft Windows Server 2003 R2 Standard

Microsoft(R) Windows Server(R) 2003 R2, Standard x64 Edition

Windows Server 2008

Windows Server 2008#

Windows Server 2008 Enterprise

Microsoft(R) Windows Server(R) 2008 Enterprise

Microsoft(R) Windows Server(R) 2008 Enterprise without Hyper-V(R)

Microsoft Windows Server 2008 Standard

Microsoft(R) Windows Server(R) 2008 Standard

Microsoft(R) Windows Server(R) 2008 Standard without Hyper-V(R)

Windows Server 2008 R2

Windows Server 2008 Datacenter

Microsoft(R) Windows Server(R) 2008 R2 Datacenter

Windows Server 2008 Enterprise

Microsoft(R) Windows Server(R) 2008 R2 Enterprise

Windows Server 2008 Foundation

Microsoft(R) Windows Server(R) 2008 R2 Foundation

Windows Server 2008 Standard

Microsoft(R) Windows Server(R) 2008 R2 Standard

Windows Server 2012

Windows Server 2012#

Windows Server 2012 Datacenter

Microsoft(R) Windows Server(R) 2012 Datacenter

Windows Server 2012 Standard

Microsoft(R) Windows Server(R) 2012 Standard

Windows Server 2012 R2

Windows Server 2012 R2 Datacenter

Microsoft(R) Windows Server(R) 2012 R2 Datacenter

Windows Server 2012 R2 Standard

Microsoft(R) Windows Server(R) 2012 R2 Standard

Windows Server 2016

Windows Server 2016 Datacenter

Microsoft(R) Windows Server(R) 2016 Datacenter

Windows Server 2016 Standard

Microsoft(R) Windows Server(R) 2016 Standard

Windows Server 2019

Windows Server 2019 Datacenter

Microsoft(R) Windows Server(R) 2019 Datacenter

Windows Server 2019 Standard

Microsoft(R) Windows Server(R) 2019 Standard

Windows Server 2022

Windows Server 2022 Datacenter

Microsoft(R) Windows Server(R) 2022 Datacenter

Windows Server 2022 Standard

Microsoft(R) Windows Server(R) 2022 Standard

Windows Vista

Windows Vista Business

Microsoft(R) Windows Vista(R) Business

Windows Vista Enterprise

Microsoft(R) Windows Vista(R) Enterprise

Windows Vista Home Basic

Microsoft(R) Windows Vista(R) Home Basic

Windows Vista Home Premium

Microsoft(R) Windows Vista(R) Home Premium

Windows Vista Ultimate

Microsoft(R) Windows Vista(R) Ultimate

Windows XP

Windows XP Home Edition

Microsoft(R) Windows(R) XP Home Edition Operating System

Windows XP Professional (x86)

Microsoft(R) Windows(R) XP Professional Operating System

Windows 95

Microsoft(R) Windows(R) 95 Operating System

Windows 98

Microsoft(R) Windows(R) 98 Operating System

Windows Live Mail

Windows Live(TM) Mail

Windows Me

Microsoft(R) Windows(R) Millennium Edition Operating System

Windows Media Player

Windows Media(R) Player

Windows NT 4.0

Microsoft(R) Windows NT(R) Server Enterprise Edition Version 4.0

Microsoft(R) Windows NT(R) Server Network Operating System Version4.0

Microsoft(R) Windows NT(R) Workstation Operating System Version4.0

Windows NT 3.51

Microsoft(R) Windows NT(R) Server Network Operating System Version3.51

Microsoft(R) Windows NT(R) Workstation Operating System Version3.51

Windows Server Failover Cluster

Microsoft(R) Windows Server(R) Failover Cluster

Windows Mail

Windows(R) Mail

#: If Windows Server 2003 R2 is written, Windows Server 2003 does not include Windows Server 2003 R2. The same also applies to Windows Server 2008 and Windows Server 2012.

(4) Acronyms

Acronym

Full name or meaning

API

Application Programming Interface

ARP

Address Resolution Protocol

AVI

Audio Video Interleave

BIOS

Basic Input / Output System

BMP

Bit Map

BOM

Byte Order Mark

CA

Certificate Authority

CD

Compact Disc

CD-R

Compact Disc Recordable

CD-ROM

Compact Disc Read Only Memory

CF

CompactFlash

CIDR

Classless Inter-Domain Routing

CPU

Central Processing Unit

CSV

Comma Separated Values

DB

Database

DBMS

Database Management System

DCOM

Distributed Component Object Model

DES

Data Encryption Standard

DHCP

Dynamic Host Configuration Protocol

DMZ

DeMilitarized Zone

DVD

Digital Versatile Disc

FC

Fibre Channel

FD

Floppy Disk

FQDN

Fully Qualified Domain Name

FTP

File Transfer Protocol

HTTP

Hyper Text Transfer Protocol

HTTPS

Hyper Text Transfer Protocol Secure

ICCID

Integrated Circuit Card ID

ICMP

Internet Control Message Protocol

ID

IDentification

IDE

Integrated Drive Electronics

IEEE

Institute of Electrical and Electronic Engineers

IMEI

International Mobile Equipment Identity

IP

Internet Protocol

ISAPI

Internet Server Application Programming Interface

ISMS

Information Security Management System

IT

Information Technology

JSON

JavaScript Object Notation

KVM

Keyboard Video Mouse

LAN

Local Area Network

MAC

Media Access Control

MDM

Mobile Device Management

NAPT

Network Address Port Translation

NAS

Network Attached Storage

NAT

Network Address Translation

NTFS

NT File System

OAuth

Open Authorization

OS

Operating System

PC

Personal Computer

PDA

Personal Digital Assistant

PDCA

Plan Do Check Action

PGP

Pretty Good Privacy

RAM

Random Access Memory

REST

Representational State Transfer

RFB

Remote Framebuffer

RFC

Request for Comments

SAMAC

Association of SAM Assessment & Certification

SD

Secure Digital

SHA

Secure Hash Algorithm

SIM

Subscriber Identity Module

SMTP

Simple Mail Transfer Protocol

SNMP

Simple Network Management Protocol

SOAP

Simple Object Access Protocol

SSD

Solid State Drive

SSL

Secure Socket Layer

TCP

Transmission Control Protocol

TLS

Transport Layer Security

UAC

User Account Control

UDID

Unique Device IDentifier

UDP

User Datagram Protocol

URL

Uniform Resource Locator

USB

Universal Serial Bus

UTC

Universal Time, Coordinated

VDI

Virtual Desktop Infrastructure

VLAN

Virtual Local Area Network

VNC

Virtual Network Computing

VPN

Virtual Private Network

VRAM

Video Random Access Memory

WAN

Wide Area Network

WMI

Windows Management Instrumentation

XML

Extensible Markup Language

(5) Fonts and symbols used in this manual

Fonts and symbols used in explanations

Text formatting

Description

Character string

Italic characters indicate a variable.

Example: A date is specified in YYYYMMDD format.

Bold - Bold

Indicates selecting menu items in succession.

Example: Select File - New.

This example means that you select New from the File menu.

key + key

Indicates pressing keys on the keyboard at the same time.

Example: Ctrl + Alt + Delete means pressing the Ctrl, Alt, and Delete keys at the same time.

/

Slashes between multiple items represent the word "or".

Example: A/B means A or B.

Conventions in syntax explanations

Symbols

Convention

String

Indicates a variable.

[ ]

Square brackets indicate that the enclosed item or items are optional.

Example: [A] means that you can specify A or nothing.

{ }

Curly brackets indicate that one of the enclosed items must be selected. Items are delimited by vertical bars (|).

Example: {A|B|C} means you must specify A, B, or C.

|

A vertical bar separates multiple items, and has the meaning of OR.

Example: A|B|C means A, B, or C.

(6) About Help

JP1/IT Desktop Management 2 provides the following online help information:

Window explanation help

This help explains about the currently displayed operation window. You can view the help by clicking the Help button in the operation window.

(7) Conventions: KB, MB, GB, and TB

This manual uses the following conventions:

1 KB (kilobyte) is 1,024 bytes. 1 MB (megabyte) is 1,024² bytes. 1 GB (gigabyte) is 1,024³ bytes. 1 TB (terabyte) is 1,024⁴ bytes. 1 PB (petabyte) is 1,024⁵ bytes.

B. Glossary

This section explains the terminology used in JP1/IT Desktop Management 2.

A

Active Directory server

A server with Active Directory installed. An Active Directory server connects to JP1/IT Desktop Management 2 in systems that manage devices by linking with Active Directory.

added management item

A custom management item added to the asset information managed by JP1/IT Desktop Management 2. By creating added management items, administrators can manage information tailored to their needs.

Administration scope

A user account parameter that defines the scope of the administrator's responsibility within the organization.

administrator computer

The computer a JP1/IT Desktop Management 2 administrator uses to log in to JP1/IT Desktop Management 2.

agent

A program installed on computers managed by JP1/IT Desktop Management 2. The agent reports information to JP1/IT Desktop Management 2 - Manager, and controls the computer based on instructions received from JP1/IT Desktop Management 2 - Manager. The program name is JP1/IT Desktop Management 2 - Agent.

Note that there are Windows, UNIX, Linux, and Mac versions for JP1/IT Desktop Management 2 - Agent. For the sake of identification, a computer on which the Windows version of the agent is installed is called a Windows agent, a computer on which the UNIX or Linux version of the agent is installed is called an agent for UNIX, and a computer on which the Mac version of the agent is installed is called an agent for Mac.

agent configurations

The settings used to set up the agent on a managed computer. Agent configurations are kept on the management server. You can remotely change how an agent is configured by creating agent configurations from an operation window and assigning them to the agent.

agentless

A managed device without JP1/IT Desktop Management 2 - Agent installed.

Asset management using Asset Console

A feature that manages assets by using Asset Console, which is a JP1/IT Desktop Management 2 component. Asset management using an operation window is called as such.

authentication server

A server used to manage access permissions for JP1 users. One authentication server must be installed for each user authentication block. This server can be used to manage all JP1 users.

B

blacklist method

A method of controlling network access by specifying devices that are not allowed to connect to the network. Devices not specified in the list are allowed to connect to the network.

C

chat server

A connection destination for computers that will be taking part in a chat session.

Citrix XenApp and Microsoft RDS server

A server on which Citrix XenApp and Microsoft RDS (Remote Desktop Services) are installed. You can install an agent on the server on which Citrix XenApp and Microsoft RDS have been installed and manage it with JP1/IT Desktop Management 2.

client workstation

An agent for UNIX or Mac that connects with a managing server via a relay system.

connection list

A feature that lets you manage connection-destination computers for the remote control function independently, without using the JP1/IT Desktop Management 2 operation module.

combined management

When Microsoft Intune is used as a MDM System, install Agents on managed devices to manage both Microsoft Intune and JP1/IT Desktop Management 2 - Manager.

contract company information

A class of asset information managed by JP1/IT Desktop Management 2. Contract company information consists of contact information for companies from which an organization has licensed software or entered into an agreement regarding a device (hardware asset).

contract company list

A list used to manage contract company information.

contract information

A class of asset information managed by JP1/IT Desktop Management 2. Contract information consists of information about contracts related to devices (hardware assets) and licensed software.

controller

A program that remotely controls a managed computer.

custom group

A group created by an administrator for a specific purpose. You can use custom groups to group the information managed by JP1/IT Desktop Management 2 in meaningful ways.

D

database manager

A tool used to back up and restore the database, and reorganize the database area.

default agent configuration

A group of agent configurations provided by JP1/IT Desktop Management 2. These settings include the connection-target management server, installation parameters, and other settings needed to set up the agent.

default policy

A security policy provided by JP1/IT Desktop Management 2. This policy contains the basic settings required to maintain a secure environment.

The default policy is assigned to managed computers by default. It is also assigned if you remove a security policy from a managed computer to which no other security policies are assigned.

device information

Information that JP1/IT Desktop Management 2 collects from managed devices. Device information is required for managing computers, and includes the hardware usage and installed software types on the managed computers. You can view device information in the Device Inventory view of the Inventory module.

diagnosis

The process of evaluating a system by assessing its security status. You can view the results of a diagnosis in a report.

directly under

From the viewpoint of any management server, devices or settings that are managed by the management server are called directly under the server. For example, computers directly under the local server refers to the computers, the agent of which connects to the local server.

Distribution using Remote Install Manager

A feature of distribution using Remote Install Manager (which is a JP1/IT Desktop Management 2 component). You can also use a command for distribution. This is one of the two distribution features provided by JP1/IT Desktop Management 2, and the other is ITDM-compatible distribution.

E

end workstation

An agent for UNIX or Mac that connects with a managing server directly without passing through a relay system.

external media

Writable media such as USB memory and external hard drives. You can use external media to install offline management agents and to collect device information from computers that are being managed offline.

H

hardware asset information

A class of asset information managed by JP1/IT Desktop Management 2. Information about the devices (hardware assets) held by an organization is registered as hardware asset information.

HIBUN log

Logs that are recorded by HIBUN.

I

information area

An area that appears in the right side of the operation window. The information displayed in this area depends on the menu item selected in the menu area on the left side of the window.

information collection tool

A tool that collects device information from computers being managed offline. The information collection tool consists of the getinv.vbs command and files containing the information needed to collect device information.

installation set

A program that helps users install and set up JP1/IT Desktop Management 2 - Agent in one operation. An installation set is created on a management server, and provides an installer that handles the installation and setup of the agent.

installed software

The software installed on a managed computer. JP1/IT Desktop Management 2 automatically collects information about installed software as device information.

internet gateway server

The server used to keep track of the managed computers connected via the outside network such as the Internet by using JP1/IT Desktop Management 2. Place this server in the demilitarized zone (DMZ) of the corporate network.

ITDM2 authentication

A method for authenticating user accounts in the JP1/IT Desktop Management 2 system. User accounts are created in the JP1/IT Desktop Management 2 operation window. This is the standard method for authenticating user accounts in the JP1/IT Desktop Management 2 system.

ITDM2 user

A user account that is registered in and managed by JP1/IT Desktop Management 2. User accounts are created in the JP1/IT Desktop Management 2 operation window.

In contrast, user accounts that are registered in and managed by the JP1/Base authentication server are referred to as JP1 users.

ITDM-compatible distribution

A feature of distribution using the Distribution (ITDM-compatible) operation window, which is one of the two distribution features provided by JP1/IT Desktop Management 2. The other distribution feature is one that uses Remote Install Manager.

J

JCR file

A file used by JP1/IT Desktop Management 2 to store video information. Video recorded during a remote control session is saved as a JCR file with the extension JCR. You can play back JCR files in the remote control player.

JP1/IT Desktop Management 2

A system that manages IT assets from device management, security management, and asset management perspectives.

JP1/IT Desktop Management 2 - Agent

A program installed on computers managed by JP1/IT Desktop Management 2.

JP1/IT Desktop Management 2 - Asset Console

A program installed on the asset management server.

JP1/IT Desktop Management 2 - Manager

A program that provides the server functionality of JP1/IT Desktop Management 2.

JP1/IT Desktop Management 2 - Network Monitor

A program installed on a computer that monitors the network.

JP1/IT Desktop Management 2 - Operations Director

A system designed for small or middle-scale companies to manage no more than 1,000 computers. It has limited functionality compared with JP1/IT Desktop Management 2 - Manager.

JP1/IT Desktop Management 2 - Smart Device Manager

A program that enables operation management and security countermeasures for smart devices.

JP1/NETM/Network Monitor

A program that monitors the network and controls the network connections of devices. JP1/NETM/NM is installed on a network control appliance.

JP1/NETM/Network Monitor - Manager

A program that centrally manages JP1/NETM/NM. JP1/NETM/NM - Manager is installed on the management server in systems that link with JP1/NETM/NM - Manager.

JP1 authentication

A method for centrally managing and authenticating user accounts in JP1/Base. User accounts are created in JP1/Base and referred to as JP1 users. If another JP1 product is using JP1 authentication, the user account of that product can be used.

JP1 permission level

A permission level indicates the types of operations that a JP1 user can perform on a management target (resource). In JP1/IT Desktop Management 2, operations are defined by permissions and task allocations. The access permissions of JP1 users are managed as a combination of the type of management target (resource) and the operations that can be performed on that type of management target.

JP1 resource group

In JP1/IT Desktop Management 2, management targets (resources) are managed in groups referred to as JP1 resource groups. In JP1/IT Desktop Management 2, JP1 resource groups are managed separately for each instance of JP1/IT Desktop Management 2 - Manager.

JP1 user

A user account that is registered in and managed by the JP1/Base authentication server. User accounts are created in JP1/Base.

In contrast, user accounts that are registered in and managed by JP1/IT Desktop Management 2 are referred to as ITDM2 users.

judgment

The process of assessing the device information collected from each computer by JP1/IT Desktop Management 2 against a security policy, and assigning a security level (violation level) for each item in the security policy and for the computer in general.

judgment-excluded user settings file

A file that specifies OS user accounts to exclude from security status judgment.

L

license key file

A file provided to purchasers of JP1/IT Desktop Management 2 licenses. A license key file is used to activate a license.

local server

From the viewpoint of any management server, the management server itself.

M

managed-software information

A class of asset information managed by JP1/IT Desktop Management 2. JP1/IT Desktop Manager uses managed-software information to keep track of software licenses. You can display the number of software licenses for each piece of managed software, and see how many of those licenses are in use. You can also manage several versions of the same software as one set of managed-software information.

management relay server

The server on which JP1/IT Desktop Management 2 - Manager is installed as a management relay server. In a multi-server configuration system, a primary management server and management relay servers can be collectively called management servers.

Provide a management relay server when you want to operate JP1/IT Desktop Management 2 separately for each department or network configuration. Just as with a relay system, distribution using Remote Install Manager enables you to reduce the load that job execution or package distribution places on the network.

management server

A computer on which JP1/IT Desktop Management 2 - Manager is installed. This can be also called a managing server or manager in a description regarding distribution using Remote Install Manager.

managing device

From the viewpoint of any device or asset, the management server that manages the device or asset. For example, the managing device of a computer refers to the management server that is specified as a connection destination by the agent installed on the computer.

mandatory software

Software that must be installed on every computer in an organization. Mandatory software is one aspect of a security policy.

MDM linkage

External device administration system and JP1/IT Desktop Management 2 work together to get device information and to direct actions.

MDM product

A product that manages smart devices. An MDM product is installed on an MDM server, and links with JP1/IT Desktop Management 2 to manage smart devices.

MDM server

A server with an MDM solution installed. An MDM server connects with JP1/IT Desktop Management 2 when you manage smart devices by linking with an MDM product.

MDM system

A generic name for the MDM products that manage smart devices. Or an external device managed system.

menu area

An area that appears in the left side of the operation window. The menu displayed in this area depends on the selected module. Select a menu item to display the corresponding information in the information area on the right side of the operation window.

multi-server configuration

A hierarchical system that consists of a primary management server and multiple management relay servers. The system might include a relay system as a component.

N

network control appliance

An appliance product with JP1/NETM/NM installed. By linking with JP1/NETM/NM - Manager, you can use JP1/IT Desktop Management 2 to control the network connections in network segments that are monitored by a network control appliance.

network control list

Settings that define whether individual devices are allowed to connect to the network. You can also permit a device to access the network for a set period of time.

network monitor

A feature that automatically detects when a device without permission (a device that is not registered as a management target or exclusion target) is connected to the network, and controls the network connection.

network monitor agent

A program installed on a computer that monitors the network. The network monitor agent is installed automatically when you select a computer that is managed online in the operation module and enable the network monitor. The program name is JP1/IT Desktop Management 2 - Network Monitor.

network monitor settings

Settings that define how network monitor controls the network connections of devices that establish new connections to network segments with the network monitor feature enabled.

O

offline management

A method of using external media to manage computers that the management server cannot access over the network. In contrast to online management.

offline management agent

An agent that is configured to not connect to the management server in the agent configurations. Install an offline management agent on computers that you want to manage offline. In contrast to an online management agent.

offline management framework

A framework used to manage computers that the management server cannot access over the network. This includes standalone computers and computers connected to an isolated network at a remote site.

online management

A way to manage computers that are connected to the management server by a network. In contrast to offline management.

online management agent

An agent that is configured to communicate with the higher systems in the agent configurations. Install an online management agent on computers that you want to manage online. In contrast to offline management agent.

operation log

Log information about operations performed on managed computers. You can collect operation logs from computers that are managed online.

P

package (for ITDM-compatible distribution)

A set of software programs or files to be distributed to other computers, which is registered in JP1/IT Desktop Management 2 from the Distribution (ITDM-compatible) window. You can also use this window to distribute a package.

primary management server

A server on which JP1/IT Desktop Management 2 - Manager is installed, and is located at the top of a multi-server configuration. In a multi-server configuration system, a primary management server and management relay servers can be collectively called management servers.

prohibited software

Software whose use is prohibited within an organization. Prohibited software is one aspect of a security policy.

R

recommended security policy

A security policy provided by JP1/IT Desktop Management 2. The settings in this policy are designed to create a robust security environment.

Relay system

A server on which JP1/IT Desktop Management 2 - Agent is installed as a relay system. Using a relay system can reduce the load caused by remote installation and remote collection on the management server and the network. The program name is JP1/IT Desktop Management 2 - Agent.

Remote collection

A feature of batch collection of files stored in the managed computers by using Remote Install Manager.

remote control agent

A component of the agent program. All remote control functions become available when a standard connection is used between the remote control agent and the controller.

remote control feature

A feature that allows a user to connect to a remote computer and control it using keyboard and mouse operations.

remote control player

A video player that plays back video recorded in a remote control session. The remote control player lets you pause and skip the video as needed.

Remote installation

A feature of batch distribution of software programs and files from the management server to users' computers via the network.

Remote Install Manager

A component of JP1/IT Desktop Management 2. Install this component if you want to perform distribution using Remote Install Manager.

removable disk

A recordable disk that can be removed from a disk drive.

report

A window that presents information compiled from the JP1/IT Desktop Management 2 database for a certain purpose. You can then print the information displayed on the screen.

request server

A feature that processes connection requests for the remote control function.

revision history

Information that serves as a record of changes made to the device information of a managed computer. You can view revision history from the operations module, or output it to a CSV file for archival purposes.

revision history archive

Revision history entries output as a CSV file for archival purposes.

RFB

A communication protocol used to access remote computers over a network. RFB is primarily used in Virtual Network Computing (VNC), and supports communication between computers running different operating systems. JP1/IT Desktop Management 2 uses RFB to remotely control agentless computers and computers running OSs other than Windows.

S

SAMAC software dictionary file for offline updates

A file used to register a software dictionary provided by SAMAC to the software dictionary in JP1/IT Desktop Management 2.

search

The process of discovering devices connected to the network in a specified network range, and devices registered with Active Directory.

security policy

A set of rules that define the criteria for determining violation levels, and actions to perform when certain conditions are met. You can define security policies on the management server and assign them to managed computers.

In a security policy, you can set criteria for determining the violation level of a computer, and define actions that take place automatically under certain conditions. You can also configure the system to warn the user when a computer reaches a particular violation level.

single-server configuration

A system in which JP1/IT Desktop Management 2 is operated with a single management server. The minimum configuration and basic configuration are categorized as single-server configurations.

smart device

A small, portable terminal device such as a smartphone, tablet PC, or PDA.

software dictionary

Software dictionary information that is provided by SAMAC and registered in JP1/IT Desktop Management 2. Software dictionary is a type of software information that is managed by JP1/IT Desktop Management 2.

software license information

A class of asset information managed by JP1/IT Desktop Management 2. Software license information is used to manage software licenses for individual purchases (at the asset level).

support information file

A file used to register information about the latest program updates information in JP1/IT Desktop Management 2.

support service site

A Web site to provide support services. JP1/IT Desktop Management 2 can acquire the latest updates for the OS and Internet Explorer, and anti-virus products by connecting to the support service site over the Internet.

suspicious file transfer

A suspicious operation detected when the following actions are deemed suspicious in a security policy:

Send/Receive E-mail with Attachments

Use Web/FTP Server

Copy/Move the File to External Device

suspicious print operation

A suspicious operation detected when Large Number of Printing Jobs is selected as a target of suspicious activity monitoring in a security policy.

system administrator permission

A permission you can assign when you create a user account in JP1/IT Desktop Management 2. A user with this permission has full access to the management features of JP1/IT Desktop Management 2, with the exception of user account management.

T

task

An single act of installing software distributed from the management server, distributing files, or uninstalling software. Each software or file distribution task involves the distribution of a specific package.

task allocation

A user account parameter that defines the tasks for which an administrator is responsible. By setting up user accounts with the appropriate combination of task allocations and permissions, you can limit the operations an administrator can perform to those appropriate to his or her role.

tool for applying policy offline

A tool used to apply a security policy to agents installed on offline-managed computers. The tool for applying policy offline consists of the setsecpolicy.vbs command and files containing the information needed to applying the security policy.

U

update group

A group of update programs to be applied or removed together. By specifying an update group in a security policy, you can apply or remove the update programs in that group to or from all computers that are subject to the security policy.

user management permission

A permission you can assign when you create a user account in JP1/IT Desktop Management 2. A user with this permission is able to add and delete user accounts in JP1/IT Desktop Management 2.

V

view permission

A permission assigned when you create a user account in JP1/IT Desktop Management 2. A user with this permission is able to view modules other than the Settings module, but cannot add new information or change existing settings.

violation level

A rating that indicates the security risk posed by a computer. A computer's violation level is determined by assessing it against a security policy. There are six violation levels: Critical, Important, Warning, Safe, Unknown, and Out of Target.

VNC

Software used to remotely control another computer over a network.

W

whitelist method

A method of controlling network access by specifying devices that are allowed to connect to the network. Devices not specified in the list are blocked from connecting to the network.

Windows Update

A program that applies updates to Windows, Internet Explorer, and other products provided by Microsoft.

Index

A

acquiring

device information for agentless devices[1]

acquiring (when connection destination of agent is turned off)

operation logs[1]

acquiring information from agentless devices[1]

acquiring operation logs

disk space requirements guidelines[1]

prerequisites[1]

acquiring Windows update

prerequisite[1]

acquiring Windows updates

note[1]

acquisition (agentless devices)[1]

action item related to security judgment[1]

Active Directory

device information[1]

importing group configuration[1]

linkage[1]

parameters[1]

Active Directory linkage

cautionary notes[1]

configuration[1]

Active Directory search

setting connection destinations[1]

Active Directory searches

parameters[1]

Active Directory server[1]

administration scopes

user accounts[1]

administrator's computer[1]

prerequisites[1]

agent

distributing to online managed computers[1]

distribution to online managed computers[1]

installing[1]

parameters[1]

agent/agentless management

functional differences[1], [2]

agent configurations

assigning to online-managed computers[1]

Agent deployment parameter[1]

parameter (agent deployment)[1]

agentless

configuration[1]

agentless devices

acquiring device information[1]

agentless management[1]

parameters[1]

Agent Manager window

menus[1]

Agent settings[1]

all assets

calculating costs[1]

checking costs[1]

allowed for use

USB device types[1]

allowing network access

judgment result of security policy[1]

AMT

parameters[1]

prerequisites for use[1]

analysis

before operation[1]

network monitoring requirements[1]

analyzing

management options required in multi-server configuration[1]

management targets[1]

periodic maintenance needs[1]

anti-virus product

judging security status[1]

judgment target[1]

Antivirus Software Details[1]

applying asset field definitions

multi-server configuration[1]

applying security measures

online managed computers[1]

applying software search conditions

multi-server configuration[1]

assessment level

calculation in Security Diagnosis Reports[1]

asset association information

exporting[1]

importing[1]

Asset Detail Reports[1]

asset fields

data sources[1]

data types[1]

asset field types

that can be customized[1]

asset information

associating[1]

checking[1]

exporting[1]

importing[1]

list of fields[1]

managing[1]

shared management items[1]

asset management

flow[1]

prerequisites[1]

assets

managing[1]

Assets module

difference with Inventory module[1]

filters[1]

Assets module operation[1]

asset status

managing[1]

assigning

security policy[1]

assignment

managing for software licenses[1]

associating

asset information[1]

devices and hardware assets[1]

attached files are saved

notes on collecting operation logs[1]

authentication configuration (agentless devices)[1]

authentication methods for user accounts[1]

automated countermeasures

against security policy violations[1]

automatically registering

Windows Update files[1]

automatic control

network access[1]

automatic countermeasure

ITDM-compatible distribution for security[1]

automatic execution

timing[1]

automatic information acquisition

types of Windows updates[1]

automatic installation

agent to management relay server[1]

automatic notification

contents of message[1]

automatic update

controller program[1]

Automatic update

judging settings[1]

automatic updating

network control list[1]

auto protect of anti-virus product

judgment condition[1]

available operations by user account permission[1]

B

backing up

operation logs on management server[1]

backing up operation logs

management server[1]

backup

output data[1]

balloon tips

display on user computers[1]

basic configuration[1]

basic module layout[1]

basic system configuration[1]

behavior

when distribution is performed on user computers[1]

when operations are restricted on user computers[1]

when users are directed to restart computers[1]

when users are directed to turn off computers[1]

BitLocker Drive Encryption Details[1]

blacklist

network access management[1]

blocking network access

judgment result of security policy[1]

C

caching

distributed packages (ITDM-compatible distribution)[1]

calculating

costs for hardware assets[1]

costs for software licenses[1]

costs for the all assets[1]

calculation

assessment level in Security Diagnosis Reports[1]

energy consumption (theoretical value)[1]

ideal energy consumption (theoretical value)[1]

calculation schedules

reports[1]

cases in which settings are applied after a restart[1]

cautionary notes

Active Directory linkage[1]

controller files in user environments[1]

file transfer during remote control[1]

MDM linkage[1]

network monitor[1]

remote control[1]

remote control in multi-language environments[1]

restarting computers[1]

shutdown[1]

cautions

product licenses[1]

CD-ROM Drive Details[1]

Change priority function[1]

changing

network access control agent[1]

chat

using[1]

chat server icon

using[1]

Chat window

menus[1], [2]

checking

asset information[1]

status of management relay servers under local server[1]

usage status of software licenses[1]

checking controller connection status[1]

checking status

Windows update[1]

cluster

configuration[1]

cluster system

operations[1]

collecting

device information[1], [2]

information entered by users[1]

registry information[1]

software information[1]

user information[1]

collecting files

using Remote Install Manager[1]

collecting logs

suspicious movements of files[1]

suspicious print operations[1]

collecting operation log

notes[1]

collecting operation logs

notes[1]

notes for device operations[1]

notes for window operations[1]

prerequisites[1]

collecting operation logs for file downloads

notes[1]

collecting operation logs for file uploads

notes[1]

collecting revision history

multi-server configuration[1]

collecting web access operation logs

prerequisites and notes[1]

commands

using[1]

computer[1]

computers

managing offline[1]

computers managed offline

distribution using Remote Install Manager[1]

computers managed online

ITDM-compatible distribution[1]

computers with software installed

displaying[1]

conditions

checking for large numbers of print jobs[1]

determining whether file is to be monitored[1]

power control[1]

configuration

Active Directory linkage[1]

agentless[1]

cluster[1]

internet gateway[1]

MDM linkage[1]

minimum[1]

network monitoring[1]

offline management[1]

remote control[1]

support service linkage[1]

configurations for management

different of security judgment[1]

configuring Active Directory searches

parameters[1]

configuring authentication information for agentless devices[1]

configuring automatic update of network control list

parameters[1]

configuring network searches

parameters[1]

connecting to remote computer

controller[1]

connection log

remote control[1]

connection mode

changing[1]

remote control[1]

connection modes

multiple connections[1]

connection-target computers

setting search ranges[1]

status[1]

connectivity with lower versions[1]

considerations

user account[1]

contents of message

automatically notification[1]

contract fields

formats in imported CSV files[1]

imported CSV files[1]

contract information

managing[1]

managing with associated software license information[1]

mapping key[1]

contract status

managing[1]

contract vendor fields

formats in imported CSV files[1]

imported CSV files[1]

contract vendor list

mapping key[1]

controller

connecting to remote computer[1]

special keys provided by default[1]

controller connection status

checking[1]

controller files in user environments

cautionary notes[1]

controller program

automatic update[1]

controlling

devices[1]

network access[1], [2]

network connections[1]

smart devices[1]

controlling interface

remote control[1]

costs

calculating for all assets[1]

calculating for hardware assets[1]

calculating for software licenses[1]

checking for all assets[1]

checking for hardware assets[1]

checking for software licenses[1]

countermeasures

security policy violation[1]

CPUs

prerequisite[1]

creating

groups[1]

creating user account

efficient internal controls[1]

D

database

examining[1]

managing[1]

overview[1]

data sources

asset fields[1]

data traffic

network search[1]

data types

asset fields[1]

default policy[1]

defining

software search conditions[1]

deleting

duplicate device information[1]

reports[1]

department definition

process for[1]

department group

process for[1]

detailed filter

using[1]

detecting device

by network monitoring function[1]

determining whether file is to be monitored

conditions for suspicious file movements[1]

deterrence targets

devices[1]

device[1]

available security management[1]

detecting[1]

status display conditions[1]

device information

acquired from Active Directory[1]

acquired from MDM system[1]

acquiring for agentless devices[1]

collected in update processing[1]

collecting[1]

collection timing[1]

deleting duplicate information[1]

shared management items[1]

types of[1]

updating[1]

device information acquisition (agentless administrative shares)[1]

device information collection

timing[1]

device information reporting to higher management server

automatic[1]

manual[1]

device information which can be collected in revision history and conditions to detect change[1]

device management

prerequisites[1]

device operations

notes on collecting operation logs[1]

devices

associating with hardware assets[1]

controlling[1]

designating as management target upon discovery[1]

deterrence targets[1]

discovering[1]

identifying relation with hardware assets[1]

managing[1]

remote control[1]

searching Active Directory[1]

status information that can be collected[1]

write operation restriction[1]

device status

information that can be collected[1]

device status and product license

relationship[1]

device statuses

conditions of display[1]

device types

supported as managed devices[1]

DHCP environments

remote control[1]

difference

between Inventory module and Assets module[1]

difference of security judgment

configurations for management[1]

Differences due to the large-scale management option[1]

discovering

devices[1]

discovering networked devices

overview[1]

discovery

Active Directory[1]

network[1]

discovery conditions[1]

disk space

requirements[1]

disk space requirements

management server[1]

disk space requirements guidelines

data folder for acquiring operation logs[1]

operation log backup folder[1]

operation log database[1]

display

balloon tips on user computers[1]

displaying

computers with software installed[1]

events[1]

reports[1]

system summary[1]

displaying connection status

remote control[1]

distributed packages (ITDM-compatible distribution)

caching[1]

distributing

agent to online managed computers[1]

product licenses[1]

distributing files efficiently

Remote Install Manager[1]

distributing software and files

Remote Install Manager[1]

distributing Windows update

prerequisite[1]

distributing Windows updates

judging results[1]

distribution

behavior on user computers[1]

Distribution (ITDM-compatible)

filters[1]

distribution function

prerequisites[1]

distribution function (ITDM-compatible distribution)

software types that can be uninstalled[1]

Distribution module operation[1]

downgrade licenses

managing[1]

E

editing device information

managed by a management relay server under the local server[1]

efficient internal controls

creating user account[1]

emails are sent and received

information and notes about collected operation logs[1]

energy consumption (theoretical value)[1]

calculation[1]

enforcement of security rules for IT devices[1]

environment setup

remote control[1]

estimates[1]

event notification

parameters[1]

events

displaying[1]

format[1]

output[1]

severity[1]

types[1]

updating device information[1]

Events module

filters[1]

Events module operation[1]

examining

database[1]

system configuration[1]

excluding user accounts from security status judgment target[1]

exclusion target[1]

exclusive communication destinations for blocked devices

managing[1]

executing task

when user is logged off (ITDM-compatible distribution)[1]

expired contracts

email notification[1]

exporting

asset association information[1]

asset information[1]

network connection information[1]

External system linkage configuration[1]

F

features

JP1/IT Desktop Management 2[1]

list of[1]

fields

asset information[1]

file/folder operations

information and notes about collected operation logs[1]

files

distributing to computers managed online (ITDM-compatible distribution)[1]

files are sent and received

notes on collecting operation logs[1]

file transfer

canceling[1]

displaying status[1]

remote control[1]

File Transfer window

menus[1]

File Transfer window of Download Manager

menus[1]

filters

Assets module[1]

Distribution (ITDM-compatible)[1]

Events module[1]

Inventory module[1]

JP1/IT Desktop Management 2[1]

Network Filter Settings view[1]

Security module[1]

using[1]

flow

asset management[1]

folders

list of[1]

format

events[1]

format of a user settings file excluded from security status judgment[1]

formats

a CSV file used to import asset association information[1]

contract fields in imported CSV files[1]

contract vendor fields in imported CSV files[1]

hardware asset fields in imported CSV files[1]

managed software fields in imported CSV files[1]

software license fields in imported CSV files[1]

full picture of IT device status[1]

functional differences between agent/agentless management[1], [2]

functions

prerequisites[1]

G

Getting Started

wizard[1]

Green IT

judging criteria[1]

group configuration

importing from Active Directory[1]

groups

creating[1], [2]

guidelines

disk space for revision history archive[1]

disk space for revision history database[1]

recommended disk space[1]

H

Hard Disk Details[1]

hardware asset fields

formats in imported CSV files[1]

imported CSV files[1]

hardware asset information

managing[1]

managing with associated information[1]

mapping key[1]

hardware assets

associating with devices[1]

calculating costs[1]

checking costs[1]

identifying relation with devices[1]

hardware information[1]

Hibun Details[1]

Home module

panels[1]

Home module operation[1]

how violation level is judged[1]

I

ideal energy consumption (theoretical value)[1]

calculation[1]

identifying

related devices and hardware assets[1]

identifying security vulnerabilities[1]

imported CSV files

asset association information[1]

contract fields and formats[1]

contract vendor fields and formats[1]

hardware asset fields and formats[1]

managed software fields and formats[1]

software license fields and formats[1]

importing

asset association information[1]

asset information[1]

network connection information[1]

importing and exporting updated program list[1]

Importing HIBUN logs into the management server[1]

incoming files

prerequisite for collecting source information when checking[1]

information and notes

operation logs collected (when emails are sent and received)[1]

operation logs collected for file/folder operations[1]

operation logs for startup and blockage of programs[1]

information area[1]

information collected

type of operation log[1]

information entered by users

collecting[1]

installation

parameters[1]

procedure[1]

installation set

parameters[1]

installed software information[1]

installing

agent[1]

internet gateway

Prerequisites for installation[1]

internet gateway configuration[1]

Inventory Detail Reports[1]

Inventory module

difference with Assets module[1]

filters[1]

Inventory module operation[1]

investigating

suspicious file movements using operation logs[1]

IP device[1]

ITDM-compatible distribution

distributing software and files to computers managed online[1]

enforced as automatic countermeasure for security[1]

executing task when user is logged off[1]

judging result of software installation executed by distribution function[1]

managing packages and tasks[1]

notes[1]

postponing download or installation on computer to which package is distributed[1]

power control by distribution function[1]

preparation for distribution[1]

reducing load by distribution[1]

types of software that can be uninstalled by distribution function[1]

items

security policy[1]

IT network monitoring[1]

J

JP1/IM linkage configuration[1]

JP1/IM server[1]

JP1/IT Desktop Management 2

features[1]

filters[1]

JP1/NETM/NM - Manager linkage

configuration[1]

network control function[1]

parameters[1]

judging

latest program updates installed[1]

security status[1]

security status for mandatory software[1]

specified program updates applied[1]

updates installed[1]

user-defined security settings[1]

judging criteria

Green IT[1]

judging result

software installation executed by distribution function (ITDM-compatible distribution)[1]

judging results

distributing Windows updates[1]

judging security status

anti-virus product[1]

prohibited services[1]

prohibited software[1]

judging settings

Automatic update[1]

judgment condition for auto protect of anti-virus product[1]

judgment target

anti-virus product[1]

K

Keyboard Details[1]

L

large numbers of print jobs

conditions for checking[1]

latest program update

judging whether installed[1]

license status

managing[1]

limit values

list of[1]

linkage

Active Directory[1]

MDM systems[1]

list of

limit values[1]

list of folders[1]

list of parameters[1]

list of processes[1]

list of services[1]

lists of properties[1]

load

reducing by distribution (ITDM-compatible distribution)[1]

location definition

process for[1]

location group

process for[1]

locking

user accounts[1]

logging in

operation window of management relay server under local server[1]

Log Out[1]

lower versions

connectivity with[1]

M

mail notification

updating update list[1]

mail server

parameters[1]

Malware-infected device control function through Microsoft Intune linkage[1]

managed computers

behavior when disconnected from network[1]

managed software fields

formats in imported CSV files[1]

imported CSV files[1]

managed software information

managing[1]

mapping key[1]

management

agentless[1]

management configuration

offline[1]

management relay server[1]

management server[1]

disk space requirements[1]

managing operation logs[1]

prerequisites[1]

management target[1]

supported devices[1]

management targets

analyzing[1]

managing

asset information[1]

assets[1]

asset status[1]

assignment of software licenses[1]

contract information[1]

contract status[1]

database[1]

devices[1]

discovered devices[1]

exclusive communication destinations for blocked devices[1]

hardware asset information[1]

hardware asset information associated with other information[1]

large system[1]

license status[1]

managed software information[1]

network connections[1]

network control list[1]

network monitor settings[1]

operation logs[1]

packages[1]

remote control connection targets[1]

security[1]

security policy[1]

security status[1]

software license information[1]

software license information and associated contract information[1]

tasks[1]

update groups[1]

upgrade licenses and downgrade licenses[1]

user accounts[1]

virtual computers[1]

Windows updates[1]

managing assets

multi-server configuration[1]

Managing connected devices[1]

managing device information

online managed computers[1]

managing devices

multi-server configuration[1]

Managing devices connected via the Internet[1]

Managing devices connected via VPN[1]

Managing devices used outside the company[1]

managing network connections

multi-server configuration[1]

managing operation logs

management server[1]

multi-server configuration[1]

managing packages and tasks

ITDM-compatible distribution[1]

managing product licenses

multi-server configuration[1]

mandatory software

judging security status[1]

manually registering

Windows Update files[1]

MDM linkage

cautionary notes[1]

configuration[1]

parameters[1]

MDM server[1]

MDM system

device information[1]

MDM systems

linkage[1]

mechanism for acquiring device information from agentless devices[1]

memory

requirements[1]

Memory Details[1]

menu area[1]

menus

Agent Manager window[1]

Chat window[1], [2]

File Transfer window[1]

File Transfer window of Download Manager[1]

remote control[1]

remote control in full screen mode[1]

Remote Control Player window[1]

Remote Control window[1]

message notification

security status[1]

Microsoft Intune Information[1]

minimum configuration[1]

miscellaneous information[1], [2]

module layout[1]

module operation (Assets module)[1]

module operation (Distribution (ITDM-compatible) module)[1]

module operation (Events module)[1]

module operation (Home module)[1]

module operation (Inventory module)[1]

module operation (Reports module)[1]

module operation (Security module)[1]

module operation (Settings module)[1]

Monitor Details[1]

Mouse Details[1]

multi-server configuration[1], [2]

agent configuration of managed computer[1]

analysis before operation[1]

applying asset field definitions[1]

applying software search conditions[1]

collecting revision history[1]

deleting device information[1]

information displayed in the operation windows[1]

managing assets[1]

managing devices[1]

managing network connections[1]

managing operation logs[1]

managing product licenses[1]

mechanism of changing managing device[1]

offline management[1]

remote control[1]

security management[1]

N

NAT Environment Configuration[1]

NAT environments

remote control[1]

network

controlling access manually[1]

prerequisites[1]

network access

controlling manually[1]

managing using blacklisting[1]

managing using whitelisting[1]

network access control

automatic[1]

network access control agent

changing[1]

Network Adapter Details[1]

network connection information

exporting[1]

importing[1]

network connections

controlling[1]

managing[1]

network control function

JP1/NETM/NM - Manager linkage[1]

NX NetMonitor/Manager[1]

network control list

automatic updating[1]

configuring automatic update[1]

managing[1]

settings[1]

network details[1]

Network Filter Settings view

filters[1]

network monitor

cautionary notes[1]

devices accessible to blocked devices[1]

displaying status[1]

prerequisites[1]

network monitoring

configuration[1]

network monitoring agent[1]

network monitoring function

detecting devices[1]

network monitoring requirements

analysis[1]

network monitor settings

controlling network access[1]

managing[1]

network search

data traffic[1]

network searches

parameters[1]

notes

collecting logs for device operations[1]

collecting operation log[1]

collecting operation logs[1]

collecting operation logs (when files are sent and received)[1]

collecting operation logs for file downloads[1]

collecting operation logs for file uploads[1]

collecting operation logs for window operations[1]

collecting operation logs when attached files are saved[1]

distribution (ITDM-compatible distribution)[1]

restart[1]

restricting use of devices[1]

setting security policy[1]

shutdown[1]

user computers[1]

Notes

acquiring Windows updates[1]

prohibited operations are restricted[1]

restricting printing[1]

restricting startup of software[1]

Notes when running anti-virus software[1]

notification

expired contracts[1]

notification target

users[1]

NX NetMonitor/Manager linkage

network control function[1]

O

Offline installation[1]

offline management[1]

configuration[1]

in multi-server configuration[1]

online managed computers

applying security measures[1]

managing device information[1]

online management

assigning agent configurations[1]

operating status

displaying for network monitor[1]

operation

procedure[1]

Operation in a large-scale environment[1], [2]

operation log backup folder

disk space requirements guidelines[1]

operation log database

disk space requirements guidelines[1]

operation logs

acquiring (when connection destination of agent is turned off)[1]

backing up and restoring[1]

backup on management server[1]

information and notes for file/folder operations[1]

investigating suspicious file movements[1]

managing[1]

notes on collecting (when files are sent and received)[1]

notes on collecting when attached files are saved[1]

notes on power on/shutdown operations[1]

periodically exporting[1]

recreating index of database[1]

restoring to management server[1]

startup and blockage of programs[1]

types[1]

operation log settings

parameters[1]

operation logs for print operations

prerequisites and notes on collection[1]

operations

cluster system[1]

user computer[1]

operations are restricted on user computers

behavior[1]

operation windows

differences due to administration scopes[1]

OS details[1]

OS Security Details[1]

output

events[1]

output data

backup[1]

overview

database[1]

product licenses[1]

P

Package (ITDM-compatible distribution)[1]

package distribution

tasks[1]

packages

ITDM-compatible distribution[1]

managing[1]

panels

list of[1]

parameters

Active Directory[1]

Active Directory searches[1]

agent[1]

agentless management[1]

AMT[1]

configuring Active Directory searches[1]

configuring automatic update of network control list[1]

configuring network searches[1]

event notification[1]

installation[1]

installation set[1]

JP1/NETM/NM - Manager linkage[1]

list of[1]

mail server[1]

MDM linkage[1]

network searches[1]

operation log settings[1]

report duration and start date[1]

revision history configuration[1]

security schedule[1]

setup[1]

summary report[1]

support service[1]

user account[1]

PDCA cycle

security management functionality[1]

performance[1]

Performance[1]

periodically exporting

operation logs[1]

periodic maintenance needs

analyzing[1]

peripheral[1]

permissions

user account[1]

playback

remote control[1]

port number list[1]

postponing

download or installation on computer to which package is distributed (ITDM-compatible distribution)[1]

power control

conditions[1]

distribution function (ITDM-compatible distribution)[1]

power on/shutdown operation logs[1]

preparation

before operation[1]

for distribution (ITDM-compatible distribution)[1]

prerequisite

acquiring Windows update[1]

CPUs[1]

distributing Windows update[1]

prerequisites

acquiring operation logs[1]

administrator's computer[1]

asset management[1]

collecting operation logs[1]

computer on which agent is installed[1]

computer on which controller is installed[1]

computer on which internet gateway is installed[1]

computer on which network monitor is enabled[1]

computer on which relay system is installed[1]

device management[1]

distribution function[1]

functions[1]

network[1]

network monitor[1]

remote control[1]

reports[1]

security control[1]

system[1]

user of AMT[1]

prerequisites

management server[1]

prerequisites and notes

collecting web access operation logs[1]

operation logs collected for print operations[1]

prerequisites for agentless management[1], [2]

primary management server[1]

printer details[1]

Printer Details[1]

printing

reports[1]

print operations

prerequisites and notes on collecting operation logs[1]

Priority distribution[1]

Priority distribution function[1]

procedure

installation[1], [2]

installation and operation[1]

operation[1], [2]

process for

department definition[1]

department group[1]

location definition[1]

location group[1]

Processor Details[1]

product

benefits[1]

overview[1], [2]

security policies[1]

product benefits[1]

product licenses[1]

authorizing registration for management relay servers[1]

cautions[1]

distributing to management relay servers[1]

overview[1]

product overview[1], [2]

program modules[1]

prohibited operations

restricting[1]

prohibited operations are restricted

notes[1]

prohibited services

judging security status[1]

prohibited software

judging security status[1]

properties

lists of[1]

purpose-built system configuration

example[1]

R

recommended disk space

guidelines[1]

recommended security policy[1]

recording

remote control[1]

recording files

setting[1]

recreating index

operation log database[1]

registering

devices accessible to blocked devices[1]

Registering device information by using the API[1]

registering licenses

on management relay servers[1]

registry information

collecting[1]

relationship

device status and product license[1]

relay system[1]

Prerequisites for installation[1]

remote control[1]

canceling file transfer[1]

cautionary notes[1]

cautionary notes on file transfer[1]

changing connection mode on remotely controlled computer[1]

configuration[1]

connection log[1]

controlling interface[1]

devices[1]

DHCP environments[1]

displaying connection status[1]

entering special keys[1]

environment setup[1]

features[1]

file transfer[1]

full screen mode[1]

functional differences between connection methods[1]

issuing connection requests to controllers[1]

managing connection targets[1]

menus[1]

multi-server configuration[1]

NAT environments[1]

operating menu bar (full screen mode)[1]

prerequisites[1]

receiving requests from request agents[1]

registering special keys[1]

search range for connection-target computers[1]

setting authentication information[1]

setting connection mode[1]

status of connection-target computers[1]

transferring clipboard data[1]

use in multi-language environments[1]

user computers[1]

viewing transfer status[1]

remote control in DHCP environments[1]

remote control in NAT environments[1]

remote control operations at user side[1]

remote control playback[1]

Remote Control Player window

menus[1]

remote control process[1]

remote control recording[1]

remote control sessions

settings for efficient video recording[1]

viewing recording status[1]

remote control using Windows authentication

user permissions[1]

Remote Control window

menus[1]

Remote Install Manager

collecting files[1]

distributing files efficiently[1]

distributing packages to computers managed offline[1]

distributing software and files[1]

Removable Drive Details[1]

report duration and start date

parameters[1]

reports

Asset Detail Reports[1]

calculation schedules[1]

deleting[1]

displaying[1]

Inventory Detail Reports[1]

prerequisites[1]

printing[1]

Security Detail Reports[1]

Security Diagnosis Reports[1]

Summary Reports[1]

types[1]

viewing[1]

Reports module operation[1]

requirements

disk space[1]

memory[1]

resolving security vulnerabilities[1]

restart

notes[1]

restarting computers

cautionary notes[1]

restoring

operation logs to management server[1]

restoring operation logs

management server[1]

restricting

prohibited operations[1]

restricting printing

notes[1]

restricting startup of software

notes[1]

restricting use of devices

notes[1]

restriction on character

that can be set for Text type data[1]

restrictions

operations to device managed by management relay server under local server[1]

Restrictions when the large-scale management option is enabled[1]

return value[1], [2]

revision history

archive disk space requirements[1]

database disk space requirements[1]

revision history

configuration parameters[1]

revision history configuration

parameters[1]

RFB connection[1]

S

searching

devices registered in Active Directory[1]

security

managing[1]

timing of automated countermeasures[1]

security control

prerequisites[1]

Security Detail Reports[1]

Security Diagnosis Reports[1]

calculation of assessment level[1]

security information[1]

security judgment

action item[1]

user accounts[1]

security management

device available[1]

functionality supporting PDCA cycle[1]

multi-server configuration[1]

Security module

filters[1]

Security module operation[1]

security policies

provided by product[1]

security policy

assigning[1]

items that can be set[1]

managing[1]

type of violation level[1]

violation levels[1]

security policy violation

countermeasures[1]

security policy violations

automated countermeasures[1]

security schedule

parameters[1]

security status

judging[1]

managing[1]

message notification[1]

security status judgment

timing[1]

security status judgment target

excluding user accounts[1]

services and processes

list of[1]

service status transitions[1]

Set priority function[1]

setting

recording files[1]

software search conditions[1]

setting authentication information

remote control[1]

setting connection destinations

Active Directory search[1]

setting security policy

notes[1]

settings for efficient video recording

remote control sessions[1]

Settings module operation[1]

setting to begin recording at remote connection[1]

setting user permissions

remote control using Windows authentication[1]

setup

parameters[1]

severity

events[1]

shared management items

asset information[1]

device information[1]

shutdown

cautionary notes[1]

notes[1]

simple filter

using[1]

smart device information[1]

smart devices

collecting information from MDM system[1]

controlling[1]

software

distributing to computers managed online (ITDM-compatible distribution)[1]

software information

collecting[1]

software installation[1]

return value[1]

software license fields

formats in imported CSV files[1]

imported CSV files[1]

software license information

managing[1]

managing with associated contract information[1]

mapping key[1]

software licenses

calculating costs[1]

checking costs[1]

checking usage status[1]

managing assignment[1]

software maintenance[1]

software search conditions

defining[1]

setting[1]

software types

uninstalled by distribution function (ITDM-compatible distribution)[1]

Sound Card Details[1]

source information

prerequisite for collecting (when checking incoming files)[1]

specified program updates

judging whether installed[1]

standard connection[1]

startup and blockage of programs

information and notes about operation logs[1]

summary report

parameters[1]

Summary Reports[1]

supported anti-virus products

updating[1]

support service

parameters[1]

support service linkage

configuration[1]

support service site[1]

suspicious file movements

conditions for determining whether file is to be monitored[1]

investigating on operation logs[1]

suspicious movements of files

collecting logs[1]

suspicious out-movement of files

notes[1]

suspicious print operations

collecting logs[1]

system components[1]

system configuration

examining[1]

system design[1]

system information

computer information[1]

device type[1]

that can be collected[1]

system prerequisites[1]

system summary

displaying[1]

T

tabs[1]

task[1]

task allocation

available operations[1]

task allocations

user accounts[1]

tasks

for package distribution[1]

for uninstallation[1]

ITDM-compatible distribution[1]

managing[1]

Text type data

restriction on character[1]

timing

automatic execution[1]

device information collection[1], [2]

timing

security status judgment[1]

tracked date

updating[1], [2]

transferring clipboard data

remote control[1]

type of operation log

information collected[1]

types

asset fields that can be customized[1]

events[1]

operation logs[1]

reports[1]

types of Windows updates

automatic information acquisition[1]

U

uninstallation

tasks[1]

uninstallation of software

return value[1]

update groups

managing[1]

update list

updating[1]

updates

judging whether installed[1]

updating

device information[1], [2]

supported anti-virus products[1]

tracked date[1], [2]

update list[1]

updating update list

mail notification[1]

upgrade licenses

managing[1]

usage status

checking for software licenses[1]

USB device types

allowed for use[1]

user account

considerations[1]

parameters[1]

permissions[1]

user accounts

administration scopes[1]

available operations by task allocation[1]

locking[1]

managing[1]

security judgment[1]

task allocations[1]

user computer

operations[1]

user computers

display of balloon tips[1]

notes[1]

user-defined groups

overview[1]

user-defined security settings

judging[1]

user details[1]

user entry

user information[1]

user information

collecting[1]

user entry[1]

user permissions

remote control using Windows authentication[1]

users

notification target from agent[1]

users are directed to restart computers

behavior[1]

users are directed to turn off computers

behavior[1]

using

chat feature[1]

commands[1]

detailed filter[1]

filters[1]

simple filter[1]

V

Video Controller Details[1]

viewing

reports[1]

viewing recording status

remote control sessions[1]

violation level[1]

violation levels

judged by security policy[1]

virtual computers

managing[1]

W

whitelist

network connection management[1]

window operations

notes on collecting operation logs[1]

Windows Service Details[1]

Windows update

checking status[1]

Windows Update Details[1]

Windows Update files

automatically registering[1]

manually registering[1]

Windows updates

managing[1]

wizard

Getting Started[1]

write operation restriction

devices[1]